@straiffi/archon 1.8.20 → 1.8.22

package/dist/server/lib/executionProfiles.js

@@ -0,0 +1,324 @@
+import { createHash } from 'node:crypto';
+export const EXECUTION_PROFILE_SCHEMA_VERSION = 2;
+export const MAX_EXECUTION_PROFILE_PAYLOAD_BYTES = 16 * 1024;
+export const MAX_EXECUTION_PROFILE_NETWORK_DESTINATIONS = 32;
+const PROFILE_KEYS = [
+    'schema_version',
+    'compatibility',
+    'provider_preference',
+    'build_eligible',
+    'isolation',
+    'workspace_access',
+    'credential_requirements',
+    'fallback',
+    'integration_access',
+    'remote_git',
+    'resources',
+    'network',
+];
+const LEGACY_PROFILE_KEYS = [
+    'schema_version',
+    'compatibility',
+    'provider_preference',
+    'build_eligible',
+    'isolation',
+    'workspace_access',
+    'credential_requirements',
+    'fallback',
+    'integration_access',
+    'remote_git',
+    'resources',
+    'network_enforcement',
+];
+const CREDENTIAL_KEYS = [
+    'id',
+    'purpose',
+    'workload',
+    'agent',
+    'model_provider',
+    'authentication_mode',
+    'required_protection',
+];
+const isRecord = (value) => (typeof value === 'object' && value !== null && !Array.isArray(value));
+const hasOnlyKeys = (value, keys) => (Object.keys(value).every(key => keys.includes(key)));
+const compareCredentials = (left, right) => left.id.localeCompare(right.id);
+const HOSTNAME_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/;
+const IPV4_LITERAL_PATTERN = /^\d{1,3}(?:\.\d{1,3}){3}$/;
+export const MAX_EXECUTION_PROFILE_NETWORK_HOST_BYTES = 253;
+const compareStrings = (left, right) => (left < right ? -1 : left > right ? 1 : 0);
+const compareDestinations = (left, right) => compareStrings(left.host, right.host)
+    || (left.port ?? 0) - (right.port ?? 0)
+    || compareStrings(left.purpose ?? '', right.purpose ?? '');
+const normalizeNetworkDestination = (value) => {
+    if (!isRecord(value) || !hasOnlyKeys(value, ['host', 'port', 'purpose'])) {
+        return 'network destinations contain unsupported fields';
+    }
+    if (typeof value.host !== 'string') {
+        return 'network destination host must be a string';
+    }
+    const host = value.host.toLowerCase();
+    if (Buffer.byteLength(host, 'utf8') > MAX_EXECUTION_PROFILE_NETWORK_HOST_BYTES) {
+        return `network destination host must not exceed ${MAX_EXECUTION_PROFILE_NETWORK_HOST_BYTES} bytes`;
+    }
+    const wildcard = host.startsWith('*.');
+    const hostname = wildcard ? host.slice(2) : host;
+    if (hostname.includes(':')
+        || IPV4_LITERAL_PATTERN.test(hostname)
+        || !HOSTNAME_PATTERN.test(hostname)) {
+        return 'network destination host must be an exact hostname or a *.domain wildcard subdomain';
+    }
+    if (value.port !== undefined
+        && (typeof value.port !== 'number' || !Number.isInteger(value.port) || value.port < 1 || value.port > 65535)) {
+        return 'network destination port must be an integer between 1 and 65535';
+    }
+    if (value.purpose !== undefined
+        && (typeof value.purpose !== 'string' || value.purpose.trim().length === 0 || value.purpose.length > 256)) {
+        return 'network destination purpose must be a short non-empty string';
+    }
+    return {
+        host: wildcard ? `*.${hostname}` : hostname,
+        ...(value.port !== undefined ? { port: value.port } : {}),
+        ...(value.purpose !== undefined ? { purpose: value.purpose.trim() } : {}),
+    };
+};
+const normalizeNetworkSection = (value) => {
+    if (!isRecord(value) || !hasOnlyKeys(value, ['mode', 'destinations'])) {
+        return 'execution profile network section contains unsupported fields';
+    }
+    if (value.mode !== 'unrestricted' && value.mode !== 'allowlist') {
+        return 'execution profile network mode is unsupported';
+    }
+    if (!Array.isArray(value.destinations)) {
+        return 'execution profile network destinations must be an array';
+    }
+    if (value.destinations.length > MAX_EXECUTION_PROFILE_NETWORK_DESTINATIONS) {
+        return `execution profile network accepts at most ${MAX_EXECUTION_PROFILE_NETWORK_DESTINATIONS} destinations`;
+    }
+    const destinations = [];
+    for (const candidate of value.destinations) {
+        const normalized = normalizeNetworkDestination(candidate);
+        if (typeof normalized === 'string') {
+            return normalized;
+        }
+        destinations.push(normalized);
+    }
+    if (value.mode === 'unrestricted' && destinations.length > 0) {
+        return 'unrestricted network mode cannot declare destinations';
+    }
+    if (value.mode === 'allowlist' && destinations.length === 0) {
+        return 'execution profile network allowlist requires at least one destination';
+    }
+    const canonical = [...destinations].sort(compareDestinations);
+    const deduped = canonical.filter((destination, index) => (index === 0 || compareDestinations(destination, canonical[index - 1]) !== 0));
+    return { mode: value.mode, destinations: deduped };
+};
+const normalizeCredential = (value) => {
+    if (!isRecord(value) || !hasOnlyKeys(value, CREDENTIAL_KEYS)) {
+        return 'credential requirements contain unsupported fields';
+    }
+    if (typeof value.id !== 'string' || !/^[a-z][a-z0-9_-]{0,63}$/.test(value.id)) {
+        return 'credential requirement id must be a lowercase logical identifier';
+    }
+    if (value.purpose !== 'model_authentication' || value.workload !== 'build') {
+        return 'credential requirements must be for Build model authentication';
+    }
+    if (value.agent !== 'opencode' && value.agent !== 'claude') {
+        return 'credential requirement agent must be opencode or claude';
+    }
+    if (typeof value.model_provider !== 'string' || !/^[a-z][a-z0-9_-]{0,63}$/.test(value.model_provider)) {
+        return 'credential requirement model_provider must be a lowercase logical identifier';
+    }
+    if (value.authentication_mode !== 'api_key' && value.authentication_mode !== 'oauth') {
+        return 'credential requirement authentication_mode must be api_key or oauth';
+    }
+    if (value.required_protection !== 'docker_brokered' && value.required_protection !== 'legacy_host_inheritance') {
+        return 'credential requirement required_protection is unsupported';
+    }
+    if (value.agent === 'claude' && value.model_provider !== 'anthropic') {
+        return 'Claude credential requirements must use the anthropic model provider';
+    }
+    return {
+        id: value.id,
+        purpose: value.purpose,
+        workload: value.workload,
+        agent: value.agent,
+        model_provider: value.model_provider,
+        authentication_mode: value.authentication_mode,
+        required_protection: value.required_protection,
+    };
+};
+export const normalizeExecutionProfile = (value) => {
+    let payloadBytes;
+    try {
+        payloadBytes = Buffer.byteLength(JSON.stringify(value), 'utf8');
+    }
+    catch {
+        return { ok: false, error: 'execution profile must be JSON serializable' };
+    }
+    if (payloadBytes > MAX_EXECUTION_PROFILE_PAYLOAD_BYTES) {
+        return { ok: false, error: 'execution profile payload is too large' };
+    }
+    if (!isRecord(value)
+        || (value.schema_version !== EXECUTION_PROFILE_SCHEMA_VERSION && value.schema_version !== 1)) {
+        return { ok: false, error: 'unsupported execution profile schema_version' };
+    }
+    const isLegacyV1 = value.schema_version === 1;
+    if (!hasOnlyKeys(value, isLegacyV1 ? LEGACY_PROFILE_KEYS : PROFILE_KEYS)) {
+        return { ok: false, error: 'execution profile contains unsupported fields' };
+    }
+    if (value.compatibility !== 'governed' && value.compatibility !== 'legacy_host') {
+        return { ok: false, error: 'execution profile compatibility is unsupported' };
+    }
+    if (value.provider_preference !== 'host' && value.provider_preference !== 'docker_sandbox') {
+        return { ok: false, error: 'execution profile provider_preference is unsupported' };
+    }
+    if (typeof value.build_eligible !== 'boolean') {
+        return { ok: false, error: 'execution profile build_eligible must be boolean' };
+    }
+    if (value.isolation !== 'host_process_allowed' && value.isolation !== 'microvm_required') {
+        return { ok: false, error: 'execution profile isolation is unsupported' };
+    }
+    if (!isRecord(value.workspace_access)
+        || !hasOnlyKeys(value.workspace_access, ['mode', 'additional_mounts'])
+        || value.workspace_access.mode !== 'exact_target'
+        || (value.workspace_access.additional_mounts !== undefined && (!Array.isArray(value.workspace_access.additional_mounts)
+            || value.workspace_access.additional_mounts.length !== 0))) {
+        return { ok: false, error: 'execution profile workspace access must be the exact target without additional mounts' };
+    }
+    if (!Array.isArray(value.credential_requirements)) {
+        return { ok: false, error: 'execution profile credential_requirements must be an array' };
+    }
+    const credentialRequirements = [];
+    const credentialIds = new Set();
+    for (const candidate of value.credential_requirements) {
+        const normalized = normalizeCredential(candidate);
+        if (typeof normalized === 'string') {
+            return { ok: false, error: normalized };
+        }
+        if (credentialIds.has(normalized.id)) {
+            return { ok: false, error: `duplicate credential requirement id: ${normalized.id}` };
+        }
+        credentialIds.add(normalized.id);
+        credentialRequirements.push(normalized);
+    }
+    if (value.fallback !== 'block' && value.fallback !== 'explicit_host') {
+        return { ok: false, error: 'execution profile fallback is unsupported' };
+    }
+    if ((value.integration_access !== undefined && value.integration_access !== 'none')
+        || (value.remote_git !== undefined && value.remote_git !== 'denied')
+        || (value.resources !== undefined && value.resources !== 'provider_defaults')
+        || (value.network_enforcement !== undefined && value.network_enforcement !== 'not_requested')) {
+        return { ok: false, error: 'execution profile deferred capabilities are fixed' };
+    }
+    if (isLegacyV1 && value.network !== undefined) {
+        return { ok: false, error: 'execution profile contains unsupported fields' };
+    }
+    let network;
+    if (isLegacyV1) {
+        network = { mode: 'unrestricted', destinations: [] };
+    }
+    else {
+        if (value.network === undefined) {
+            return { ok: false, error: 'execution profile requires an explicit network section' };
+        }
+        const normalizedNetwork = normalizeNetworkSection(value.network);
+        if (typeof normalizedNetwork === 'string') {
+            return { ok: false, error: normalizedNetwork };
+        }
+        network = normalizedNetwork;
+    }
+    const profile = {
+        schema_version: EXECUTION_PROFILE_SCHEMA_VERSION,
+        compatibility: value.compatibility,
+        provider_preference: value.provider_preference,
+        build_eligible: value.build_eligible,
+        isolation: value.isolation,
+        workspace_access: { mode: 'exact_target', additional_mounts: [] },
+        credential_requirements: credentialRequirements.sort(compareCredentials),
+        fallback: value.fallback,
+        integration_access: 'none',
+        remote_git: 'denied',
+        resources: 'provider_defaults',
+        network,
+    };
+    const policy = evaluateExecutionProfileMaximumPolicy(profile);
+    if (!policy.allowed) {
+        return { ok: false, error: policy.violations.join('; ') };
+    }
+    return { ok: true, profile };
+};
+export const evaluateExecutionProfileMaximumPolicy = (profile) => {
+    const violations = [];
+    if (profile.provider_preference === 'host' && profile.network.mode === 'allowlist') {
+        violations.push('the host provider cannot enforce a network destination allowlist');
+    }
+    if (profile.compatibility === 'legacy_host') {
+        if (profile.provider_preference !== 'host' || profile.isolation !== 'host_process_allowed' || profile.fallback !== 'block') {
+            violations.push('legacy host compatibility cannot request sandbox isolation or fallback');
+        }
+        if (profile.credential_requirements.some(requirement => requirement.required_protection !== 'legacy_host_inheritance')) {
+            violations.push('legacy host compatibility only permits host-inherited credential requirements');
+        }
+    }
+    else {
+        if (profile.provider_preference === 'host' && profile.isolation === 'microvm_required') {
+            violations.push('the host provider cannot satisfy required microVM isolation');
+        }
+        if (profile.provider_preference === 'host' && profile.credential_requirements.some(requirement => requirement.required_protection === 'docker_brokered')) {
+            violations.push('the host provider cannot satisfy Docker-brokered credential protection');
+        }
+        if (profile.provider_preference === 'host' && profile.credential_requirements.some(requirement => requirement.required_protection === 'legacy_host_inheritance')) {
+            violations.push('governed host profiles cannot inherit ambient host credentials');
+        }
+        if (profile.provider_preference === 'docker_sandbox' && profile.credential_requirements.some(requirement => requirement.required_protection === 'legacy_host_inheritance')) {
+            violations.push('governed Docker Sandbox profiles cannot inherit host credentials');
+        }
+    }
+    if (profile.fallback === 'explicit_host' && profile.isolation === 'microvm_required') {
+        violations.push('explicit host fallback cannot preserve required microVM isolation');
+    }
+    return { allowed: violations.length === 0, violations };
+};
+export const serializeExecutionProfile = (profile) => JSON.stringify(profile);
+export const fingerprintExecutionProfile = (profile) => createHash('sha256')
+    .update(serializeExecutionProfile(profile), 'utf8')
+    .digest('hex');
+export const fingerprintLegacyExecutionProfileV1 = (profile) => createHash('sha256')
+    .update(JSON.stringify({
+    schema_version: 1,
+    compatibility: profile.compatibility,
+    provider_preference: profile.provider_preference,
+    build_eligible: profile.build_eligible,
+    isolation: profile.isolation,
+    workspace_access: profile.workspace_access,
+    credential_requirements: profile.credential_requirements,
+    fallback: profile.fallback,
+    integration_access: profile.integration_access,
+    remote_git: profile.remote_git,
+    resources: profile.resources,
+    network_enforcement: 'not_requested',
+}), 'utf8')
+    .digest('hex');
+export const fingerprintCredentialRequirements = (requirements) => createHash('sha256')
+    .update('archon-credential-requirements-v1\0', 'utf8')
+    .update(JSON.stringify([...requirements].sort(compareCredentials)), 'utf8')
+    .digest('hex');
+export const createExecutionProfile = (provider) => ({
+    schema_version: EXECUTION_PROFILE_SCHEMA_VERSION,
+    compatibility: provider === 'host' ? 'legacy_host' : 'governed',
+    provider_preference: provider,
+    build_eligible: true,
+    isolation: provider === 'host' ? 'host_process_allowed' : 'microvm_required',
+    workspace_access: { mode: 'exact_target', additional_mounts: [] },
+    credential_requirements: [],
+    fallback: 'block',
+    integration_access: 'none',
+    remote_git: 'denied',
+    resources: 'provider_defaults',
+    network: { mode: 'unrestricted', destinations: [] },
+});
+export const createLegacyHostCompatibilityProfile = () => createExecutionProfile('host');
+export const executionProfileSelectionMetadata = (project) => project?.active_execution_profile_revision_id
+    ? { execution_profile_revision_id: project.active_execution_profile_revision_id }
+    : {};
+//# sourceMappingURL=executionProfiles.js.map

package/dist/server/lib/executionProfiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executionProfiles.js","sourceRoot":"","sources":["../../../server/lib/executionProfiles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAWxC,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAU,CAAA;AAC1D,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,GAAG,IAAI,CAAA;AAC5D,MAAM,CAAC,MAAM,0CAA0C,GAAG,EAAE,CAAA;AAE5D,MAAM,YAAY,GAAG;IACnB,gBAAgB;IAChB,eAAe;IACf,qBAAqB;IACrB,gBAAgB;IAChB,WAAW;IACX,kBAAkB;IAClB,yBAAyB;IACzB,UAAU;IACV,oBAAoB;IACpB,YAAY;IACZ,WAAW;IACX,SAAS;CACD,CAAA;AAEV,MAAM,mBAAmB,GAAG;IAC1B,gBAAgB;IAChB,eAAe;IACf,qBAAqB;IACrB,gBAAgB;IAChB,WAAW;IACX,kBAAkB;IAClB,yBAAyB;IACzB,UAAU;IACV,oBAAoB;IACpB,YAAY;IACZ,WAAW;IACX,qBAAqB;CACb,CAAA;AAEV,MAAM,eAAe,GAAG;IACtB,IAAI;IACJ,SAAS;IACT,UAAU;IACV,OAAO;IACP,gBAAgB;IAChB,qBAAqB;IACrB,qBAAqB;CACb,CAAA;AAIV,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CAAC,CACrE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CACrE,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,KAA8B,EAAE,IAAuB,EAAE,EAAE,CAAC,CAC/E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CACpD,CAAA;AAED,MAAM,kBAAkB,GAAG,CACzB,IAA2C,EAC3C,KAA4C,EAC5C,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;AAEpC,MAAM,gBAAgB,GAAG,mFAAmF,CAAA;AAC5G,MAAM,oBAAoB,GAAG,2BAA2B,CAAA;AACxD,MAAM,CAAC,MAAM,wCAAwC,GAAG,GAAG,CAAA;AAE3D,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAElG,MAAM,mBAAmB,GAAG,CAC1B,IAAwC,EACxC,KAAyC,EACzC,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;OACrC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;OACpC,cAAc,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;AAE5D,MAAM,2BAA2B,GAAG,CAAC,KAAc,EAA+C,EAAE;IAClG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;QACzE,OAAO,iDAAiD,CAAA;IAC1D,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,2CAA2C,CAAA;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;IACrC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,wCAAwC,EAAE,CAAC;QAC/E,OAAO,4CAA4C,wCAAwC,QAAQ,CAAA;IACrG,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;IACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAChD,IACE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;WACnB,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;WACnC,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EACnC,CAAC;QACD,OAAO,qFAAqF,CAAA;IAC9F,CAAC;IACD,IACE,KAAK,CAAC,IAAI,KAAK,SAAS;WACrB,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,EAC5G,CAAC;QACD,OAAO,iEAAiE,CAAA;IAC1E,CAAC;IACD,IACE,KAAK,CAAC,OAAO,KAAK,SAAS;WACxB,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,EACzG,CAAC;QACD,OAAO,8DAA8D,CAAA;IACvE,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ;QAC3C,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAA;AACH,CAAC,CAAA;AAED,MAAM,uBAAuB,GAAG,CAAC,KAAc,EAAoC,EAAE;IACnF,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QACtE,OAAO,+DAA+D,CAAA;IACxE,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChE,OAAO,+CAA+C,CAAA;IACxD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACvC,OAAO,yDAAyD,CAAA;IAClE,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,0CAA0C,EAAE,CAAC;QAC3E,OAAO,6CAA6C,0CAA0C,eAAe,CAAA;IAC/G,CAAC;IACD,MAAM,YAAY,GAAyC,EAAE,CAAA;IAC7D,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,2BAA2B,CAAC,SAAS,CAAC,CAAA;QACzD,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,UAAU,CAAA;QACnB,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7D,OAAO,uDAAuD,CAAA;IAChE,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,uEAAuE,CAAA;IAChF,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAC7D,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC,CACvD,KAAK,KAAK,CAAC,IAAI,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAC5E,CAAC,CAAA;IACF,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAA;AACpD,CAAC,CAAA;AAED,MAAM,mBAAmB,GAAG,CAAC,KAAc,EAAkD,EAAE;IAC7F,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,CAAC;QAC7D,OAAO,oDAAoD,CAAA;IAC7D,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9E,OAAO,kEAAkE,CAAA;IAC3E,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,sBAAsB,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC3E,OAAO,gEAAgE,CAAA;IACzE,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3D,OAAO,yDAAyD,CAAA;IAClE,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QACtG,OAAO,8EAA8E,CAAA;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,mBAAmB,KAAK,SAAS,IAAI,KAAK,CAAC,mBAAmB,KAAK,OAAO,EAAE,CAAC;QACrF,OAAO,qEAAqE,CAAA;IAC9E,CAAC;IACD,IAAI,KAAK,CAAC,mBAAmB,KAAK,iBAAiB,IAAI,KAAK,CAAC,mBAAmB,KAAK,yBAAyB,EAAE,CAAC;QAC/G,OAAO,2DAA2D,CAAA;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,cAAc,KAAK,WAAW,EAAE,CAAC;QACrE,OAAO,sEAAsE,CAAA;IAC/E,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;KAC/C,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,KAAc,EAAmB,EAAE;IAC3E,IAAI,YAAoB,CAAA;IACxB,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAA;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAA;IAC5E,CAAC;IACD,IAAI,YAAY,GAAG,mCAAmC,EAAE,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAA;IACvE,CAAC;IACD,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;WACb,CAAC,KAAK,CAAC,cAAc,KAAK,gCAAgC,IAAI,KAAK,CAAC,cAAc,KAAK,CAAC,CAAC,EAC5F,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAA;IAC7E,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,cAAc,KAAK,CAAC,CAAA;IAC7C,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAA;IAC9E,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,UAAU,IAAI,KAAK,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;QAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAA;IAC/E,CAAC;IACD,IAAI,KAAK,CAAC,mBAAmB,KAAK,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,gBAAgB,EAAE,CAAC;QAC3F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAA;IACrF,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAA;IACjF,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,sBAAsB,IAAI,KAAK,CAAC,SAAS,KAAK,kBAAkB,EAAE,CAAC;QACzF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAA;IAC3E,CAAC;IACD,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC;WAC9B,CAAC,WAAW,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;WACnE,KAAK,CAAC,gBAAgB,CAAC,IAAI,KAAK,cAAc;WAC9C,CAAC,KAAK,CAAC,gBAAgB,CAAC,iBAAiB,KAAK,SAAS,IAAI,CAC5D,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,iBAAiB,CAAC;eACrD,KAAK,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,CACzD,CAAC,EACF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uFAAuF,EAAE,CAAA;IACtH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4DAA4D,EAAE,CAAA;IAC3F,CAAC;IAED,MAAM,sBAAsB,GAA4C,EAAE,CAAA;IAC1E,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAA;IACvC,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAA;QACjD,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;QACzC,CAAC;QACD,IAAI,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wCAAwC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAA;QACtF,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;QAChC,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACzC,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;QACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAA;IAC1E,CAAC;IACD,IACE,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS,IAAI,KAAK,CAAC,kBAAkB,KAAK,MAAM,CAAC;WAC5E,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC;WACjE,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,mBAAmB,CAAC;WAC1E,CAAC,KAAK,CAAC,mBAAmB,KAAK,SAAS,IAAI,KAAK,CAAC,mBAAmB,KAAK,eAAe,CAAC,EAC7F,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAA;IAClF,CAAC;IACD,IAAI,UAAU,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAA;IAC9E,CAAC;IAED,IAAI,OAAgC,CAAA;IACpC,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,EAAE,CAAA;IACtD,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAA;QACvF,CAAC;QACD,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAChE,IAAI,OAAO,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAA;QAChD,CAAC;QACD,OAAO,GAAG,iBAAiB,CAAA;IAC7B,CAAC;IAED,MAAM,OAAO,GAAqB;QAChC,cAAc,EAAE,gCAAgC;QAChD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,gBAAgB,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,iBAAiB,EAAE,EAAE,EAAE;QACjE,uBAAuB,EAAE,sBAAsB,CAAC,IAAI,CAAC,kBAAkB,CAAC;QACxE,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,kBAAkB,EAAE,MAAM;QAC1B,UAAU,EAAE,QAAQ;QACpB,SAAS,EAAE,mBAAmB;QAC9B,OAAO;KACR,CAAA;IACD,MAAM,MAAM,GAAG,qCAAqC,CAAC,OAAO,CAAC,CAAA;IAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;IAC3D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC9B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qCAAqC,GAAG,CACnD,OAAyB,EACY,EAAE;IACvC,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,IAAI,OAAO,CAAC,mBAAmB,KAAK,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACnF,UAAU,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAA;IACrF,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,mBAAmB,KAAK,MAAM,IAAI,OAAO,CAAC,SAAS,KAAK,sBAAsB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC3H,UAAU,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAA;QAC3F,CAAC;QACD,IAAI,OAAO,CAAC,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,WAAW,CAAC,mBAAmB,KAAK,yBAAyB,CAAC,EAAE,CAAC;YACvH,UAAU,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAA;QAClG,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,CAAC,mBAAmB,KAAK,MAAM,IAAI,OAAO,CAAC,SAAS,KAAK,kBAAkB,EAAE,CAAC;YACvF,UAAU,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAA;QAChF,CAAC;QACD,IAAI,OAAO,CAAC,mBAAmB,KAAK,MAAM,IAAI,OAAO,CAAC,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,WAAW,CAAC,mBAAmB,KAAK,iBAAiB,CAAC,EAAE,CAAC;YACzJ,UAAU,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAA;QAC3F,CAAC;QACD,IAAI,OAAO,CAAC,mBAAmB,KAAK,MAAM,IAAI,OAAO,CAAC,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,WAAW,CAAC,mBAAmB,KAAK,yBAAyB,CAAC,EAAE,CAAC;YACjK,UAAU,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAA;QACnF,CAAC;QACD,IAAI,OAAO,CAAC,mBAAmB,KAAK,gBAAgB,IAAI,OAAO,CAAC,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,WAAW,CAAC,mBAAmB,KAAK,yBAAyB,CAAC,EAAE,CAAC;YAC3K,UAAU,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAA;QACrF,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,eAAe,IAAI,OAAO,CAAC,SAAS,KAAK,kBAAkB,EAAE,CAAC;QACrF,UAAU,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAA;IACtF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,UAAU,EAAE,CAAA;AACzD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,OAAyB,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;AAE/F,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,OAAyB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;KAC3F,MAAM,CAAC,yBAAyB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAClD,MAAM,CAAC,KAAK,CAAC,CAAA;AAEhB,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,OAAyB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;KACnG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;IACrB,cAAc,EAAE,CAAC;IACjB,aAAa,EAAE,OAAO,CAAC,aAAa;IACpC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;IAChD,cAAc,EAAE,OAAO,CAAC,cAAc;IACtC,SAAS,EAAE,OAAO,CAAC,SAAS;IAC5B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;IAC1C,uBAAuB,EAAE,OAAO,CAAC,uBAAuB;IACxD,QAAQ,EAAE,OAAO,CAAC,QAAQ;IAC1B,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;IAC9C,UAAU,EAAE,OAAO,CAAC,UAAU;IAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;IAC5B,mBAAmB,EAAE,eAAe;CACrC,CAAC,EAAE,MAAM,CAAC;KACV,MAAM,CAAC,KAAK,CAAC,CAAA;AAEhB,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAC/C,YAA8D,EAC9D,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;KACtB,MAAM,CAAC,qCAAqC,EAAE,MAAM,CAAC;KACrD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,EAAE,MAAM,CAAC;KAC1E,MAAM,CAAC,KAAK,CAAC,CAAA;AAEhB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,QAAgC,EAAoB,EAAE,CAAC,CAAC;IAC7F,cAAc,EAAE,gCAAgC;IAChD,aAAa,EAAE,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU;IAC/D,mBAAmB,EAAE,QAAQ;IAC7B,cAAc,EAAE,IAAI;IACpB,SAAS,EAAE,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,kBAAkB;IAC5E,gBAAgB,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,iBAAiB,EAAE,EAAE,EAAE;IACjE,uBAAuB,EAAE,EAAE;IAC3B,QAAQ,EAAE,OAAO;IACjB,kBAAkB,EAAE,MAAM;IAC1B,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,mBAAmB;IAC9B,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,EAAE;CACpD,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,oCAAoC,GAAG,GAAG,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAA;AAExF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAC/C,OAAiF,EACjF,EAAE,CAAC,OAAO,EAAE,oCAAoC;IAChD,CAAC,CAAC,EAAE,6BAA6B,EAAE,OAAO,CAAC,oCAAoC,EAAE;IACjF,CAAC,CAAC,EAAE,CAAA"}