@stratusagent/permissions 0.10.0 → 0.11.0

package/dist/index.js

@@ -5,8 +5,11 @@
  */
 export { atLeastAsRisky } from '@stratusagent/core';
 import { analyzeCommand, describeCommandScope, findMatchingScope, normalizeCommandScope, SAFE_COMMAND_SCOPES, } from "./commands.js";
+import { describeOriginScope, findMatchingOriginScope, originScopeFor, } from "./origins.js";
+import { WhitelistUnreadableError, } from "./whitelist.js";
 export { analyzeCommand, describeCommandScope, findMatchingScope, matchesScope, normalizeCommandScope, parseCommandScope, sameScope, SAFE_COMMAND_SCOPES, } from "./commands.js";
-export { createFileCommandWhitelist, whitelistPathFor, } from "./whitelist.js";
+export { describeOriginScope, findMatchingOriginScope, matchesOriginScope, originScopeFor, parseOriginScope, sameOriginScope, } from "./origins.js";
+export { createFileCommandWhitelist, whitelistPathFor, WhitelistUnreadableError, } from "./whitelist.js";
 const YES = new Set(['y', 'yes', 'always', 'a']);
 const ALWAYS = new Set(['always', 'a']);
 const ABORTED = Symbol('aborted');
@@ -118,7 +121,13 @@ const summarizeInput = (input) => {
  * text from a person mid-typing, so it is read leniently and anything that
  * is not recognisably a yes is a no.
  */
-const awaitPrompt = async (context, ask, command) => {
+const awaitPrompt = async (context, ask, command, origin, 
+/**
+ * What answering "always" will actually do, decided by the caller — which
+ * is the only place that knows. Offering a lifetime the engine will not
+ * create is the same defect as hiding one it will.
+ */
+alwaysMeans) => {
     const { call, risk, session } = context;
     // The command, when there is one: for a shell call the tool name is the
     // least interesting half of the question, and an approver shown only
@@ -130,13 +139,16 @@ const awaitPrompt = async (context, ask, command) => {
     // there is no command scope to show, fall back to a compact rendering of
     // the call's input, exactly as the remote (Slack) prompt already does.
     const argumentSummary = command === undefined ? summarizeInput(call.input) : undefined;
+    // The origin goes in front of the arguments rather than into them: a
+    // selector says nothing about where a click lands, and this is the half
+    // of the question "always" widens.
+    const acting = origin === undefined ? call.toolName : `${call.toolName} on ${origin}`;
     const what = command !== undefined
         ? `${call.toolName}: ${command}`
         : argumentSummary !== undefined
-            ? `${call.toolName} (${risk}): ${argumentSummary}`
-            : `${call.toolName} (${risk})`;
-    const always = command === undefined ? 'always this session' : 'always this scope';
-    const pending = ask(`Allow ${what} for ${session.agent.name}? [y]es / [a]lways (${always}) / [N]o: `);
+            ? `${acting} (${risk}): ${argumentSummary}`
+            : `${acting} (${risk})`;
+    const pending = ask(`Allow ${what} for ${session.agent.name}? [y]es / [a]lways (${alwaysMeans}) / [N]o: `);
     // The answer is never read after this point if the turn ends first,
     // so a late yes cannot execute a tool for work that no longer exists.
     pending.catch(() => undefined);
@@ -161,12 +173,14 @@ const awaitPrompt = async (context, ask, command) => {
  * its call was not approved and carry on, not crash on the machinery that
  * was supposed to ask.
  */
-const awaitRemote = async (context, request) => {
+const awaitRemote = async (context, request, origin, oneShot) => {
     const pending = request({
         session: context.session,
         call: context.call,
         tool: context.tool,
         risk: context.risk,
+        ...(origin !== undefined ? { origin } : {}),
+        ...(oneShot ? { oneShot } : {}),
         ...(context.parkedAt ? { parkedAt: context.parkedAt } : {}),
         ...(context.signal ? { signal: context.signal } : {}),
     }).then((answer) => answer, () => 'deny');
@@ -183,9 +197,14 @@ const awaitRemote = async (context, request) => {
  * after which there is nothing left but asking. A `dangerous` tool skips
  * the scope engine entirely: its risk is a statement about the tool, and no
  * argument shape makes `rm -rf` a read.
+ *
+ * A tool that names an *origin* (`Tool.originFor`) resolves through the
+ * same two grant tiers over a different vocabulary — the site the page is
+ * on, rather than the command the call would run. It has no third tier,
+ * because there is no origin that is safe to click on out of the box.
  */
 export const createPermissionPolicy = (options) => {
-    const { mode, ask, request, onDecision, commands, destinations } = options;
+    const { mode, ask, request, onDecision, commands, destinations, origins } = options;
     if (mode === 'interactive' && !ask) {
         throw new Error('interactive permission mode needs an `ask` function to reach a human.');
     }
@@ -201,7 +220,9 @@ export const createPermissionPolicy = (options) => {
     // with no whitelist store still has to remember an answer for the rest of
     // the session, which is what `always` means at a terminal.
     const sessionScopes = new Map();
-    const report = (context, allowed, reason, command, destination) => {
+    /** The same tier for origins, and for the same reason. */
+    const sessionOrigins = new Map();
+    const report = (context, allowed, reason, command, destination, origin) => {
         onDecision?.({
             allowed,
             mode,
@@ -212,6 +233,7 @@ export const createPermissionPolicy = (options) => {
             reason,
             ...(command === undefined ? {} : { command }),
             ...(destination === undefined ? {} : { destination }),
+            ...(origin === undefined ? {} : { origin }),
         });
         return allowed;
     };
@@ -225,8 +247,78 @@ export const createPermissionPolicy = (options) => {
             // its arguments. Resolved before anything else so that the tool-wide
             // "always" below can never apply to it: one yes to `git status` must
             // not become a standing yes to every command the shell can run.
-            const command = risk === 'gated' ? context.tool.commandFor?.(call.input) : undefined;
+            // A tool that offers more than one scope hook is judged by none of
+            // them, and asks like any other gated call.
+            //
+            // Each hook narrows a call along one axis — what it runs, where it
+            // sends, what site it acts on — and each grant answers only its own
+            // question. Composing them needs a decision nobody has made: a call
+            // with two axes could reasonably need every applicable scope to
+            // authorize it, or the narrowest, and picking silently is how a
+            // grant on one axis waves through a call unapproved on the other.
+            // Falling back to a human is the answer that cannot be wrong while
+            // that decision is unmade.
+            //
+            // Nothing offers two today (`shell.run` a command, `message.send` a
+            // destination, `browser.act` an origin), so this changes nothing now
+            // — it is here so that adding one cannot quietly open that door. The
+            // guard first covered only `commandFor`, and left exactly this hole
+            // for `destinationFor`; one rule over all three has no such corner.
+            const scopeHooks = [
+                context.tool.commandFor,
+                context.tool.destinationFor,
+                context.tool.originFor,
+            ].filter((hook) => hook !== undefined).length;
+            const singlyScoped = scopeHooks <= 1;
+            // Turning the scope engines off is only half of it. The tool-wide
+            // "always" is what a tool with no scope at all falls back to, and
+            // letting a multi-hook tool reach it would be worse than the hole
+            // this rule closed: one yes, and then a session of unattended calls
+            // with neither scope consulted. A tool that asked to be judged by a
+            // scope does not get to be judged by nothing instead.
+            const multiplyScoped = scopeHooks > 1;
+            const command = risk === 'gated' && singlyScoped
+                ? context.tool.commandFor?.(call.input)
+                : undefined;
             const analysis = command === undefined ? undefined : analyzeCommand(command);
+            // Whether this tool is judged by *where* it acts, and where it is
+            // acting right now. `gated` only, for the reason a destination cannot
+            // launder a `dangerous` call either: a scope narrows a tool whose
+            // risk lives in its arguments, and `dangerous` is a statement about
+            // the tool itself.
+            //
+            // The two are separate on purpose. `scopedByOrigin` is true for any
+            // tool that offers the hook, even on a call where it answers nothing
+            // — a page that has not loaded, one closed by the idle sweep — and it
+            // is what bars the tool-wide "always" below. Without that, a click
+            // approved on a page whose origin could not be named would fall back
+            // to a standing yes to `browser.act` on every site, which is exactly
+            // the grant per-origin scopes exist to replace.
+            const scopedByOrigin = risk === 'gated'
+                && singlyScoped
+                && context.tool.originFor !== undefined;
+            // The grants first, and where the page is *after* them. Read the
+            // other way round, the store's disk read sits between the two, and a
+            // page that redirects inside it has a grant for site A allow a click
+            // on site B — the same shape as the approval wait below, with a
+            // shorter gap and no bound on it at all when the store is somebody
+            // else's. There is no await between this read and the match, so the
+            // origin a grant is checked against is where the conversation is when
+            // the decision is made, not where it was.
+            const grantedOrigins = scopedByOrigin
+                ? [
+                    ...(sessionOrigins.get(session.agent.id) ?? []),
+                    ...(origins?.whitelist ? await origins.whitelist.originsFor(session.agent.id) : []),
+                ]
+                : [];
+            const reportedOrigin = scopedByOrigin ? context.tool.originFor?.(session) : undefined;
+            // Read through the same normalizer a grant file is read through,
+            // rather than taken as written. The hook's contract is an origin, but
+            // this is what a grant is compared against — a plugin that hands back
+            // a whole page URL should get a grant on its origin, not one that
+            // silently never matches anything.
+            const originScope = reportedOrigin === undefined ? undefined : originScopeFor(reportedOrigin);
+            const origin = originScope?.origin;
             if (analysis) {
                 if (analysis.disqualifiedBy) {
                     // Never auto-approved, whatever the base command is: a safe scope
@@ -248,14 +340,23 @@ export const createPermissionPolicy = (options) => {
                     }
                 }
             }
-            else if (alwaysAllowed.has(sessionKey(session.id, call.toolName))) {
+            else if (risk !== 'dangerous'
+                && !scopedByOrigin
+                && !multiplyScoped
+                && alwaysAllowed.has(sessionKey(session.id, call.toolName))) {
                 return report(context, true, `${call.toolName} was approved for the rest of this session`);
             }
+            if (origin !== undefined) {
+                const granted = findMatchingOriginScope(origin, grantedOrigins);
+                if (granted) {
+                    return report(context, true, `${call.toolName} acted on the approved site ${describeOriginScope(granted)}`, undefined, undefined, origin);
+                }
+            }
             // The schedule's destination scope, checked before the headless
             // refusal because an unattended firing is exactly when it applies.
             // `gated` only: a destination cannot launder a `dangerous` call, the
             // same way no argument shape makes `rm -rf` a read.
-            if (risk === 'gated' && destinations) {
+            if (risk === 'gated' && singlyScoped && destinations) {
                 const destination = context.tool.destinationFor?.(call.input);
                 if (destination !== undefined
                     && await destinations.isPreauthorized(session, destination)) {
@@ -263,10 +364,19 @@ export const createPermissionPolicy = (options) => {
                 }
             }
             if (mode === 'headless') {
-                return report(context, false, command === undefined
-                    ? `${call.toolName} is ${risk} and nobody is available to approve it`
-                    : `${call.toolName} was called outside every approved scope`
-                        + `${analysis?.base ? ` (${analysis.base})` : ''} and nobody is available to approve it`, command);
+                return report(context, false, command !== undefined
+                    ? `${call.toolName} was called outside every approved scope`
+                        + `${analysis?.base ? ` (${analysis.base})` : ''} and nobody is available to approve it`
+                    : origin !== undefined
+                        // Named, because it is the actionable half: an operator
+                        // reading this at 3am needs to know which site to grant, and
+                        // an origin carries no path or query to leak while saying so.
+                        ? `${call.toolName} was called on ${origin}, which no approved site covers,`
+                            + ' and nobody is available to approve it'
+                        : scopedByOrigin
+                            ? `${call.toolName} was called on a page with no origin a grant could name,`
+                                + ' and nobody is available to approve it'
+                            : `${call.toolName} is ${risk} and nobody is available to approve it`, command, undefined, origin);
             }
             // An aborted turn must not sit on a prompt: the human would be
             // answering for work that no longer exists, and an answer arriving
@@ -279,26 +389,121 @@ export const createPermissionPolicy = (options) => {
             // refusal is reported — is deliberately shared, so a decision made in
             // Slack and one typed at a terminal cannot drift into meaning
             // different things.
+            // Whether answering "always" would remember anything at all, decided
+            // here because this is where the answer is: a `dangerous` tool never
+            // remembers, and an origin-scoped call with no page has nothing to
+            // remember. Both are certain before anyone is asked, so both surfaces
+            // can stop offering a grant the engine will not create.
+            // A command this parser cannot reduce to a scope — a pipe, a
+            // subshell, an unbalanced quote, a refspec delete — is the third
+            // one-shot shape, and the oldest: the branch below has always run it
+            // once and remembered nothing, because widening to the bare tool
+            // would hand the agent every command. Resolved here rather than
+            // after the answer so the question can say so; it is a pure function
+            // of the analysis, and the branch below reuses this exact value.
+            const commandScope = analysis ? normalizeCommandScope(analysis) : undefined;
+            const oneShot = risk === 'dangerous'
+                || multiplyScoped
+                || (scopedByOrigin && origin === undefined)
+                || (analysis !== undefined && commandScope === undefined);
+            const alwaysMeans = oneShot
+                ? risk === 'dangerous'
+                    ? 'not remembered — a dangerous tool asks every time'
+                    : multiplyScoped
+                        ? 'not remembered — this tool names more than one kind of scope'
+                        : analysis !== undefined
+                            ? 'not remembered — this command cannot be reduced to a scope'
+                            : 'not remembered — there is no page to grant'
+                : command !== undefined
+                    ? 'always this scope'
+                    : scopedByOrigin
+                        ? 'always this site'
+                        : 'always this session';
             const answer = mode === 'remote'
-                ? await awaitRemote(context, request)
-                : await awaitPrompt(context, ask, command);
+                ? await awaitRemote(context, request, origin, oneShot)
+                : await awaitPrompt(context, ask, command, origin, alwaysMeans);
             if (answer === ABORTED) {
                 return report(context, false, `${call.toolName} was cancelled while awaiting approval`);
             }
             if (answer === 'deny') {
                 return report(context, false, mode === 'remote'
                     ? `${call.toolName} was not approved`
-                    : `${call.toolName} was refused at the prompt`, command);
+                    : `${call.toolName} was refused at the prompt`, command, undefined, origin);
             }
+            /**
+             * Allow — unless the conversation moved out from under the answer.
+             *
+             * The origin was read before the wait, and the wait is a human's:
+             * fifteen minutes by default, unbounded when the timeout is zero. A
+             * page that navigates inside it (a redirect, a meta refresh, a
+             * script) would have a yes given for site A land a click on site B,
+             * with the prompt still naming A. The approver answered a question
+             * about a page; if it is not that page any more, there is no answer
+             * to act on, and re-asking is not the fix — that is a second question
+             * with the same race behind it.
+             *
+             * Every path out of the approval goes through this, and it is the
+             * *last* thing each of them does, because the answer is not the last
+             * yield: persisting a grant is a disk write, and a store somebody
+             * else wrote has no bound at all. Checking once when the answer
+             * arrives would leave exactly that window open. One chokepoint, so a
+             * path added later cannot quietly skip it.
+             *
+             * A grant persisted before the page moved is kept, and that is not a
+             * hole: the approver read that site and said always. What must not
+             * happen is the *click* landing somewhere they never saw.
+             */
+            const allowUnlessMoved = (reason, forCommand) => {
+                if (!scopedByOrigin) {
+                    return report(context, true, reason, forCommand, undefined, origin);
+                }
+                const settled = originScopeFor(context.tool.originFor?.(session) ?? '')?.origin;
+                if (settled === origin) {
+                    return report(context, true, reason, forCommand, undefined, origin);
+                }
+                const approvedOn = origin ?? 'a page with no origin';
+                return report(context, false, settled === undefined
+                    ? `${call.toolName} was approved on ${approvedOn}, and that page is no longer open`
+                        + ' — it did not run'
+                    : `${call.toolName} was approved on ${approvedOn}, but the conversation is on ${settled} now`
+                        + ' — it did not run', undefined, undefined, origin);
+            };
             if (answer === 'always') {
-                const scope = analysis ? normalizeCommandScope(analysis) : undefined;
+                if (scopedByOrigin) {
+                    if (!originScope) {
+                        // No origin to remember — a page that never loaded, or one
+                        // whose URL has no origin this engine will name. The call runs;
+                        // nothing is widened. Falling back to the tool-wide grant here
+                        // would turn "always on this page" into "always on every page",
+                        // which is the grant this whole engine replaced.
+                        return allowUnlessMoved(`${call.toolName} was approved once; there is no page origin to remember, so it will ask again`);
+                    }
+                    sessionOrigins.set(session.agent.id, [...(sessionOrigins.get(session.agent.id) ?? []), originScope]);
+                    if (origins?.whitelist) {
+                        try {
+                            await origins.whitelist.rememberOrigin(session.agent.id, originScope);
+                        }
+                        catch (error) {
+                            if (!(error instanceof WhitelistUnreadableError)) {
+                                throw error;
+                            }
+                            // Same bargain the command half makes: the answer holds for
+                            // this process, and the file that would carry it past a
+                            // restart is not written over grants nobody can read.
+                            return allowUnlessMoved(`${call.toolName} was approved, and ${describeOriginScope(originScope)} is acted on without asking for ${session.agent.id} until the daemon restarts — not saved: ${error.message}`);
+                        }
+                        origins.onScopeRemembered?.({ agentId: session.agent.id, scope: originScope });
+                    }
+                    return allowUnlessMoved(`${call.toolName} was approved, and ${describeOriginScope(originScope)} is now acted on without asking`);
+                }
+                const scope = commandScope;
                 if (analysis && !scope) {
                     // A command this parser could not reduce to a scope — a pipe, a
                     // subshell, an unbalanced quote. "Always" must not fall back to
                     // the tool-wide grant here: the approver widened one command they
                     // read, and remembering `shell.run` instead would hand the agent
                     // every command for the rest of the session.
-                    return report(context, true, `${call.toolName} was approved once; it cannot be reduced to a scope, so it will ask again`, command);
+                    return allowUnlessMoved(`${call.toolName} was approved once; it cannot be reduced to a scope, so it will ask again`, command);
                 }
                 if (scope) {
                     // A scope, never the command string (useless next time) and never
@@ -307,15 +512,45 @@ export const createPermissionPolicy = (options) => {
                     // asks again.
                     sessionScopes.set(session.agent.id, [...(sessionScopes.get(session.agent.id) ?? []), scope]);
                     if (commands?.whitelist) {
-                        await commands.whitelist.remember(session.agent.id, scope);
+                        try {
+                            await commands.whitelist.remember(session.agent.id, scope);
+                        }
+                        catch (error) {
+                            if (!(error instanceof WhitelistUnreadableError)) {
+                                throw error;
+                            }
+                            // The answer stands for as long as tier one does — this
+                            // process, for this agent, which is what the person's
+                            // "always" means without a file — and the file that would
+                            // carry it past a restart is not written over grants nobody
+                            // can read. The line says both.
+                            return allowUnlessMoved(`${call.toolName} was approved, and "${describeCommandScope(scope)}" runs without asking for ${session.agent.id} until the daemon restarts — not saved: ${error.message}`, command);
+                        }
                         commands.onScopeRemembered?.({ agentId: session.agent.id, scope });
                     }
-                    return report(context, true, `${call.toolName} was approved, and "${describeCommandScope(scope)}" now runs without asking`, command);
+                    return allowUnlessMoved(`${call.toolName} was approved, and "${describeCommandScope(scope)}" now runs without asking`, command);
+                }
+                if (risk === 'dangerous') {
+                    // The tier means "a human every time, whatever scopes exist", and
+                    // it kept that name in this change on exactly that basis — no
+                    // first-party tool is in it any more, so what it is *for* is an
+                    // operator's `toolRisks` or a plugin manifest saying it about
+                    // somebody else's code. A session-wide grant made that a promise
+                    // about the first call only (28 names this and calls tightening
+                    // it deliberate); it is now what it says.
+                    return allowUnlessMoved(`${call.toolName} was approved once; a dangerous tool is never remembered, so it will ask again`);
+                }
+                if (multiplyScoped) {
+                    // The other half of the multi-hook rule. Storing a tool-wide
+                    // grant here would be the engine answering "how do two scopes
+                    // compose?" with "they do not apply", which is the one answer
+                    // nobody would choose deliberately.
+                    return allowUnlessMoved(`${call.toolName} was approved once; it names more than one kind of scope, so it will ask again`);
                 }
                 alwaysAllowed.add(sessionKey(session.id, call.toolName));
-                return report(context, true, `${call.toolName} was approved for the rest of this session`);
+                return allowUnlessMoved(`${call.toolName} was approved for the rest of this session`);
             }
-            return report(context, true, `${call.toolName} was approved once`, command);
+            return allowUnlessMoved(`${call.toolName} was approved once`, command);
         },
     };
 };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA;;;;GAIG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,GAEpB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,SAAS,EACT,mBAAmB,GAGpB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,GAEjB,MAAM,gBAAgB,CAAC;AA4JxB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;AACjD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;AAExC,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;AAElC;;;;;;;;;GASG;AACH,MAAM,YAAY,GAAG,KAAK,EACxB,IAAgB,EAChB,MAA+B,EACF,EAAE;IAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,OAAiC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,IAAI;YACJ,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,EAAE;gBACtC,OAAO,GAAG,GAAS,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACvC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAE,QAAgB,EAAU,EAAE,CAAC,GAAG,SAAS,SAAS,QAAQ,EAAE,CAAC;AAEpG;;;GAGG;AACH,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC;;;;;;;;GAQG;AACH,MAAM,UAAU,GAAG,CAAC,KAAgB,EAAa,EAAE;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9F,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAAe,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,cAAc,GAAG,CAAC,KAAiB,EAAsB,EAAE;IAC/D,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,MAAM,GAAG,oBAAoB;QAC1C,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,6DAA6D;QACxG,CAAC,CAAC,OAAO,CAAC;AACd,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,GAAG,KAAK,EACvB,OAAwB,EACxB,GAAgD,EAChD,OAA2B,EACe,EAAE;IAC5C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACxC,wEAAwE;IACxE,qEAAqE;IACrE,yEAAyE;IACzE,wEAAwE;IACxE,iEAAiE;IACjE,wEAAwE;IACxE,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,eAAe,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvF,MAAM,IAAI,GAAG,OAAO,KAAK,SAAS;QAChC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE;QAChC,CAAC,CAAC,eAAe,KAAK,SAAS;YAC7B,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,MAAM,eAAe,EAAE;YAClD,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC;IACnC,MAAM,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,mBAAmB,CAAC;IACnF,MAAM,OAAO,GAAG,GAAG,CACjB,SAAS,IAAI,QAAQ,OAAO,CAAC,KAAK,CAAC,IAAI,uBAAuB,MAAM,YAAY,CACjF,CAAC;IACF,oEAAoE;IACpE,sEAAsE;IACtE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAE/B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;AAChD,CAAC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,WAAW,GAAG,KAAK,EACvB,OAAwB,EACxB,OAA0B,EACgB,EAAE;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC,IAAI,CACL,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAClB,GAAG,EAAE,CAAC,MAAe,CACtB,CAAC;IAEF,OAAO,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,OAAgC,EAAkB,EAAE;IACzF,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IAC3E,IAAI,IAAI,KAAK,aAAa,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,0EAA0E;IAC1E,yEAAyE;IACzE,oEAAoE;IACpE,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,kEAAkE;IAClE,wEAAwE;IACxE,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,aAAa,GAAG,IAAI,GAAG,EAA0B,CAAC;IAExD,MAAM,MAAM,GAAG,CACb,OAAwB,EACxB,OAAgB,EAChB,MAAc,EACd,OAAgB,EAChB,WAAoB,EACX,EAAE;QACX,UAAU,EAAE,CAAC;YACX,OAAO;YACP,IAAI;YACJ,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;YAC/B,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;YAC7B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;YACjC,MAAM;YACN,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YAC7C,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;SACtD,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,OAAwB;YACpC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;YAExC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,OAAO,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,oCAAoC,CAAC,CAAC;YACrF,CAAC;YAED,qEAAqE;YACrE,qEAAqE;YACrE,qEAAqE;YACrE,gEAAgE;YAChE,MAAM,OAAO,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACrF,MAAM,QAAQ,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YAE7E,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;oBAC5B,kEAAkE;oBAClE,8DAA8D;oBAC9D,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;wBACxB,OAAO,MAAM,CACX,OAAO,EACP,KAAK,EACL,GAAG,IAAI,CAAC,QAAQ,2BAA2B,QAAQ,CAAC,cAAc,EAAE,EACpE,OAAO,CACR,CAAC;oBACJ,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,MAAM,GAAG,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/F,MAAM,UAAU,GAAG;wBACjB,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;wBAC9C,GAAG,MAAM;wBACT,GAAG,CAAC,QAAQ,EAAE,UAAU,IAAI,mBAAmB,CAAC;qBACjD,CAAC;oBACF,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;oBACtD,IAAI,KAAK,EAAE,CAAC;wBACV,OAAO,MAAM,CACX,OAAO,EACP,IAAI,EACJ,GAAG,IAAI,CAAC,QAAQ,mCAAmC,oBAAoB,CAAC,KAAK,CAAC,GAAG,EACjF,OAAO,CACR,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACpE,OAAO,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,4CAA4C,CAAC,CAAC;YAC7F,CAAC;YAED,gEAAgE;YAChE,mEAAmE;YACnE,qEAAqE;YACrE,oDAAoD;YACpD,IAAI,IAAI,KAAK,OAAO,IAAI,YAAY,EAAE,CAAC;gBACrC,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC9D,IAAI,WAAW,KAAK,SAAS;uBACxB,MAAM,YAAY,CAAC,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;oBAC9D,OAAO,MAAM,CACX,OAAO,EACP,IAAI,EACJ,GAAG,IAAI,CAAC,QAAQ,OAAO,WAAW,qDAAqD,EACvF,SAAS,EACT,WAAW,CACZ,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBACxB,OAAO,MAAM,CACX,OAAO,EACP,KAAK,EACL,OAAO,KAAK,SAAS;oBACnB,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,OAAO,IAAI,wCAAwC;oBACrE,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,0CAA0C;0BACxD,GAAG,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,wCAAwC,EAC5F,OAAO,CACR,CAAC;YACJ,CAAC;YAED,+DAA+D;YAC/D,mEAAmE;YACnE,+CAA+C;YAC/C,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC5B,OAAO,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,QAAQ,4CAA4C,CAAC,CAAC;YAC9F,CAAC;YAED,sEAAsE;YACtE,kEAAkE;YAClE,sEAAsE;YACtE,8DAA8D;YAC9D,oBAAoB;YACpB,MAAM,MAAM,GAAG,IAAI,KAAK,QAAQ;gBAC9B,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,EAAE,OAAQ,CAAC;gBACtC,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,EAAE,GAAI,EAAE,OAAO,CAAC,CAAC;YAE9C,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,OAAO,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,QAAQ,wCAAwC,CAAC,CAAC;YAC1F,CAAC;YAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,OAAO,MAAM,CACX,OAAO,EACP,KAAK,EACL,IAAI,KAAK,QAAQ;oBACf,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,mBAAmB;oBACrC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,4BAA4B,EAChD,OAAO,CACR,CAAC;YACJ,CAAC;YAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACrE,IAAI,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;oBACvB,gEAAgE;oBAChE,gEAAgE;oBAChE,kEAAkE;oBAClE,iEAAiE;oBACjE,6CAA6C;oBAC7C,OAAO,MAAM,CACX,OAAO,EACP,IAAI,EACJ,GAAG,IAAI,CAAC,QAAQ,2EAA2E,EAC3F,OAAO,CACR,CAAC;gBACJ,CAAC;gBACD,IAAI,KAAK,EAAE,CAAC;oBACV,kEAAkE;oBAClE,iEAAiE;oBACjE,gEAAgE;oBAChE,cAAc;oBACd,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;oBAC7F,IAAI,QAAQ,EAAE,SAAS,EAAE,CAAC;wBACxB,MAAM,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;wBAC3D,QAAQ,CAAC,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;oBACrE,CAAC;oBACD,OAAO,MAAM,CACX,OAAO,EACP,IAAI,EACJ,GAAG,IAAI,CAAC,QAAQ,uBAAuB,oBAAoB,CAAC,KAAK,CAAC,2BAA2B,EAC7F,OAAO,CACR,CAAC;gBACJ,CAAC;gBACD,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACzD,OAAO,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,4CAA4C,CAAC,CAAC;YAC7F,CAAC;YAED,OAAO,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,oBAAoB,EAAE,OAAO,CAAC,CAAC;QAC9E,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA;;;;GAIG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,GAEpB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,cAAc,GAEf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,GAGzB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,SAAS,EACT,mBAAmB,GAGpB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,eAAe,GAEhB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,wBAAwB,GAGzB,MAAM,gBAAgB,CAAC;AAiNxB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;AACjD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;AAExC,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;AAElC;;;;;;;;;GASG;AACH,MAAM,YAAY,GAAG,KAAK,EACxB,IAAgB,EAChB,MAA+B,EACF,EAAE;IAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,OAAiC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,IAAI;YACJ,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,EAAE;gBACtC,OAAO,GAAG,GAAS,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACvC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAE,QAAgB,EAAU,EAAE,CAAC,GAAG,SAAS,SAAS,QAAQ,EAAE,CAAC;AAEpG;;;GAGG;AACH,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC;;;;;;;;GAQG;AACH,MAAM,UAAU,GAAG,CAAC,KAAgB,EAAa,EAAE;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9F,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAAe,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,cAAc,GAAG,CAAC,KAAiB,EAAsB,EAAE;IAC/D,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,MAAM,GAAG,oBAAoB;QAC1C,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,6DAA6D;QACxG,CAAC,CAAC,OAAO,CAAC;AACd,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,GAAG,KAAK,EACvB,OAAwB,EACxB,GAAgD,EAChD,OAA2B,EAC3B,MAA0B;AAC1B;;;;GAIG;AACH,WAAmB,EACuB,EAAE;IAC5C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACxC,wEAAwE;IACxE,qEAAqE;IACrE,yEAAyE;IACzE,wEAAwE;IACxE,iEAAiE;IACjE,wEAAwE;IACxE,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,eAAe,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvF,qEAAqE;IACrE,wEAAwE;IACxE,mCAAmC;IACnC,MAAM,MAAM,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,OAAO,MAAM,EAAE,CAAC;IACtF,MAAM,IAAI,GAAG,OAAO,KAAK,SAAS;QAChC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE;QAChC,CAAC,CAAC,eAAe,KAAK,SAAS;YAC7B,CAAC,CAAC,GAAG,MAAM,KAAK,IAAI,MAAM,eAAe,EAAE;YAC3C,CAAC,CAAC,GAAG,MAAM,KAAK,IAAI,GAAG,CAAC;IAC5B,MAAM,OAAO,GAAG,GAAG,CACjB,SAAS,IAAI,QAAQ,OAAO,CAAC,KAAK,CAAC,IAAI,uBAAuB,WAAW,YAAY,CACtF,CAAC;IACF,oEAAoE;IACpE,sEAAsE;IACtE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAE/B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;AAChD,CAAC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,WAAW,GAAG,KAAK,EACvB,OAAwB,EACxB,OAA0B,EAC1B,MAA0B,EAC1B,OAAgB,EAC0B,EAAE;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC,IAAI,CACL,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAClB,GAAG,EAAE,CAAC,MAAe,CACtB,CAAC;IAEF,OAAO,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,OAAgC,EAAkB,EAAE;IACzF,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACpF,IAAI,IAAI,KAAK,aAAa,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,0EAA0E;IAC1E,yEAAyE;IACzE,oEAAoE;IACpE,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,kEAAkE;IAClE,wEAAwE;IACxE,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,aAAa,GAAG,IAAI,GAAG,EAA0B,CAAC;IACxD,0DAA0D;IAC1D,MAAM,cAAc,GAAG,IAAI,GAAG,EAAyB,CAAC;IAExD,MAAM,MAAM,GAAG,CACb,OAAwB,EACxB,OAAgB,EAChB,MAAc,EACd,OAAgB,EAChB,WAAoB,EACpB,MAAe,EACN,EAAE;QACX,UAAU,EAAE,CAAC;YACX,OAAO;YACP,IAAI;YACJ,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;YAC/B,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;YAC7B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;YACjC,MAAM;YACN,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YAC7C,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;YACrD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;SAC5C,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,OAAwB;YACpC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;YAExC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,OAAO,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,oCAAoC,CAAC,CAAC;YACrF,CAAC;YAED,qEAAqE;YACrE,qEAAqE;YACrE,qEAAqE;YACrE,gEAAgE;YAChE,mEAAmE;YACnE,4CAA4C;YAC5C,EAAE;YACF,mEAAmE;YACnE,oEAAoE;YACpE,oEAAoE;YACpE,gEAAgE;YAChE,gEAAgE;YAChE,kEAAkE;YAClE,mEAAmE;YACnE,2BAA2B;YAC3B,EAAE;YACF,oEAAoE;YACpE,qEAAqE;YACrE,qEAAqE;YACrE,oEAAoE;YACpE,oEAAoE;YACpE,MAAM,UAAU,GAAG;gBACjB,OAAO,CAAC,IAAI,CAAC,UAAU;gBACvB,OAAO,CAAC,IAAI,CAAC,cAAc;gBAC3B,OAAO,CAAC,IAAI,CAAC,SAAS;aACvB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;YAC9C,MAAM,YAAY,GAAG,UAAU,IAAI,CAAC,CAAC;YACrC,kEAAkE;YAClE,kEAAkE;YAClE,kEAAkE;YAClE,oEAAoE;YACpE,oEAAoE;YACpE,sDAAsD;YACtD,MAAM,cAAc,GAAG,UAAU,GAAG,CAAC,CAAC;YAEtC,MAAM,OAAO,GAAG,IAAI,KAAK,OAAO,IAAI,YAAY;gBAC9C,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;gBACvC,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,QAAQ,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YAE7E,kEAAkE;YAClE,sEAAsE;YACtE,kEAAkE;YAClE,oEAAoE;YACpE,mBAAmB;YACnB,EAAE;YACF,oEAAoE;YACpE,qEAAqE;YACrE,sEAAsE;YACtE,mEAAmE;YACnE,qEAAqE;YACrE,qEAAqE;YACrE,gDAAgD;YAChD,MAAM,cAAc,GAAG,IAAI,KAAK,OAAO;mBAClC,YAAY;mBACZ,OAAO,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC;YAC1C,iEAAiE;YACjE,qEAAqE;YACrE,qEAAqE;YACrE,gEAAgE;YAChE,mEAAmE;YACnE,oEAAoE;YACpE,sEAAsE;YACtE,0CAA0C;YAC1C,MAAM,cAAc,GAAG,cAAc;gBACnC,CAAC,CAAC;oBACE,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;oBAC/C,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,cAAc,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACtF,iEAAiE;YACjE,sEAAsE;YACtE,sEAAsE;YACtE,kEAAkE;YAClE,mCAAmC;YACnC,MAAM,WAAW,GAAG,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;YAC9F,MAAM,MAAM,GAAG,WAAW,EAAE,MAAM,CAAC;YAEnC,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;oBAC5B,kEAAkE;oBAClE,8DAA8D;oBAC9D,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;wBACxB,OAAO,MAAM,CACX,OAAO,EACP,KAAK,EACL,GAAG,IAAI,CAAC,QAAQ,2BAA2B,QAAQ,CAAC,cAAc,EAAE,EACpE,OAAO,CACR,CAAC;oBACJ,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,MAAM,GAAG,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/F,MAAM,UAAU,GAAG;wBACjB,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;wBAC9C,GAAG,MAAM;wBACT,GAAG,CAAC,QAAQ,EAAE,UAAU,IAAI,mBAAmB,CAAC;qBACjD,CAAC;oBACF,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;oBACtD,IAAI,KAAK,EAAE,CAAC;wBACV,OAAO,MAAM,CACX,OAAO,EACP,IAAI,EACJ,GAAG,IAAI,CAAC,QAAQ,mCAAmC,oBAAoB,CAAC,KAAK,CAAC,GAAG,EACjF,OAAO,CACR,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,KAAK,WAAW;mBAC1B,CAAC,cAAc;mBACf,CAAC,cAAc;mBACf,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBAC9D,OAAO,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,4CAA4C,CAAC,CAAC;YAC7F,CAAC;YAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;gBAChE,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,MAAM,CACX,OAAO,EACP,IAAI,EACJ,GAAG,IAAI,CAAC,QAAQ,+BAA+B,mBAAmB,CAAC,OAAO,CAAC,EAAE,EAC7E,SAAS,EACT,SAAS,EACT,MAAM,CACP,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,gEAAgE;YAChE,mEAAmE;YACnE,qEAAqE;YACrE,oDAAoD;YACpD,IAAI,IAAI,KAAK,OAAO,IAAI,YAAY,IAAI,YAAY,EAAE,CAAC;gBACrD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC9D,IAAI,WAAW,KAAK,SAAS;uBACxB,MAAM,YAAY,CAAC,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;oBAC9D,OAAO,MAAM,CACX,OAAO,EACP,IAAI,EACJ,GAAG,IAAI,CAAC,QAAQ,OAAO,WAAW,qDAAqD,EACvF,SAAS,EACT,WAAW,CACZ,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBACxB,OAAO,MAAM,CACX,OAAO,EACP,KAAK,EACL,OAAO,KAAK,SAAS;oBACnB,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,0CAA0C;0BACxD,GAAG,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,wCAAwC;oBAC1F,CAAC,CAAC,MAAM,KAAK,SAAS;wBACpB,wDAAwD;wBACxD,6DAA6D;wBAC7D,8DAA8D;wBAC9D,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,kBAAkB,MAAM,kCAAkC;8BACxE,wCAAwC;wBAC5C,CAAC,CAAC,cAAc;4BACd,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,0DAA0D;kCACxE,wCAAwC;4BAC5C,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,OAAO,IAAI,wCAAwC,EAC3E,OAAO,EACP,SAAS,EACT,MAAM,CACP,CAAC;YACJ,CAAC;YAED,+DAA+D;YAC/D,mEAAmE;YACnE,+CAA+C;YAC/C,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC5B,OAAO,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,QAAQ,4CAA4C,CAAC,CAAC;YAC9F,CAAC;YAED,sEAAsE;YACtE,kEAAkE;YAClE,sEAAsE;YACtE,8DAA8D;YAC9D,oBAAoB;YACpB,qEAAqE;YACrE,qEAAqE;YACrE,mEAAmE;YACnE,sEAAsE;YACtE,wDAAwD;YACxD,6DAA6D;YAC7D,iEAAiE;YACjE,qEAAqE;YACrE,iEAAiE;YACjE,gEAAgE;YAChE,qEAAqE;YACrE,iEAAiE;YACjE,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5E,MAAM,OAAO,GAAG,IAAI,KAAK,WAAW;mBAC/B,cAAc;mBACd,CAAC,cAAc,IAAI,MAAM,KAAK,SAAS,CAAC;mBACxC,CAAC,QAAQ,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,CAAC,CAAC;YAC5D,MAAM,WAAW,GAAG,OAAO;gBACzB,CAAC,CAAC,IAAI,KAAK,WAAW;oBACpB,CAAC,CAAC,mDAAmD;oBACrD,CAAC,CAAC,cAAc;wBACd,CAAC,CAAC,8DAA8D;wBAChE,CAAC,CAAC,QAAQ,KAAK,SAAS;4BACtB,CAAC,CAAC,4DAA4D;4BAC9D,CAAC,CAAC,4CAA4C;gBACpD,CAAC,CAAC,OAAO,KAAK,SAAS;oBACrB,CAAC,CAAC,mBAAmB;oBACrB,CAAC,CAAC,cAAc;wBACd,CAAC,CAAC,kBAAkB;wBACpB,CAAC,CAAC,qBAAqB,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,KAAK,QAAQ;gBAC9B,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,EAAE,OAAQ,EAAE,MAAM,EAAE,OAAO,CAAC;gBACvD,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,EAAE,GAAI,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;YAEnE,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,OAAO,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,QAAQ,wCAAwC,CAAC,CAAC;YAC1F,CAAC;YAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,OAAO,MAAM,CACX,OAAO,EACP,KAAK,EACL,IAAI,KAAK,QAAQ;oBACf,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,mBAAmB;oBACrC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,4BAA4B,EAChD,OAAO,EACP,SAAS,EACT,MAAM,CACP,CAAC;YACJ,CAAC;YAED;;;;;;;;;;;;;;;;;;;;;;eAsBG;YACH,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAE,UAAmB,EAAW,EAAE;gBACxE,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,OAAO,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;gBACtE,CAAC;gBACD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC;gBAChF,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;oBACvB,OAAO,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;gBACtE,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,IAAI,uBAAuB,CAAC;gBACrD,OAAO,MAAM,CACX,OAAO,EACP,KAAK,EACL,OAAO,KAAK,SAAS;oBACnB,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,oBAAoB,UAAU,mCAAmC;0BAC/E,mBAAmB;oBACvB,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,oBAAoB,UAAU,gCAAgC,OAAO,MAAM;0BACzF,mBAAmB,EACzB,SAAS,EACT,SAAS,EACT,MAAM,CACP,CAAC;YACJ,CAAC,CAAC;YAEF,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,IAAI,cAAc,EAAE,CAAC;oBACnB,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,2DAA2D;wBAC3D,gEAAgE;wBAChE,+DAA+D;wBAC/D,gEAAgE;wBAChE,iDAAiD;wBACjD,OAAO,gBAAgB,CACrB,GAAG,IAAI,CAAC,QAAQ,+EAA+E,CAChG,CAAC;oBACJ,CAAC;oBACD,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;oBACrG,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;wBACvB,IAAI,CAAC;4BACH,MAAM,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;wBACxE,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,IAAI,CAAC,CAAC,KAAK,YAAY,wBAAwB,CAAC,EAAE,CAAC;gCACjD,MAAM,KAAK,CAAC;4BACd,CAAC;4BACD,4DAA4D;4BAC5D,wDAAwD;4BACxD,sDAAsD;4BACtD,OAAO,gBAAgB,CACrB,GAAG,IAAI,CAAC,QAAQ,sBAAsB,mBAAmB,CAAC,WAAW,CAAC,mCAAmC,OAAO,CAAC,KAAK,CAAC,EAAE,2CAA2C,KAAK,CAAC,OAAO,EAAE,CACpL,CAAC;wBACJ,CAAC;wBACD,OAAO,CAAC,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;oBACjF,CAAC;oBACD,OAAO,gBAAgB,CACrB,GAAG,IAAI,CAAC,QAAQ,sBAAsB,mBAAmB,CAAC,WAAW,CAAC,iCAAiC,CACxG,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,GAAG,YAAY,CAAC;gBAC3B,IAAI,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;oBACvB,gEAAgE;oBAChE,gEAAgE;oBAChE,kEAAkE;oBAClE,iEAAiE;oBACjE,6CAA6C;oBAC7C,OAAO,gBAAgB,CACrB,GAAG,IAAI,CAAC,QAAQ,2EAA2E,EAC3F,OAAO,CACR,CAAC;gBACJ,CAAC;gBACD,IAAI,KAAK,EAAE,CAAC;oBACV,kEAAkE;oBAClE,iEAAiE;oBACjE,gEAAgE;oBAChE,cAAc;oBACd,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;oBAC7F,IAAI,QAAQ,EAAE,SAAS,EAAE,CAAC;wBACxB,IAAI,CAAC;4BACH,MAAM,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;wBAC7D,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,IAAI,CAAC,CAAC,KAAK,YAAY,wBAAwB,CAAC,EAAE,CAAC;gCACjD,MAAM,KAAK,CAAC;4BACd,CAAC;4BACD,wDAAwD;4BACxD,sDAAsD;4BACtD,0DAA0D;4BAC1D,4DAA4D;4BAC5D,gCAAgC;4BAChC,OAAO,gBAAgB,CACrB,GAAG,IAAI,CAAC,QAAQ,uBAAuB,oBAAoB,CAAC,KAAK,CAAC,6BAA6B,OAAO,CAAC,KAAK,CAAC,EAAE,2CAA2C,KAAK,CAAC,OAAO,EAAE,EACzK,OAAO,CACR,CAAC;wBACJ,CAAC;wBACD,QAAQ,CAAC,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;oBACrE,CAAC;oBACD,OAAO,gBAAgB,CACrB,GAAG,IAAI,CAAC,QAAQ,uBAAuB,oBAAoB,CAAC,KAAK,CAAC,2BAA2B,EAC7F,OAAO,CACR,CAAC;gBACJ,CAAC;gBACD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;oBACzB,kEAAkE;oBAClE,8DAA8D;oBAC9D,gEAAgE;oBAChE,8DAA8D;oBAC9D,iEAAiE;oBACjE,gEAAgE;oBAChE,0CAA0C;oBAC1C,OAAO,gBAAgB,CACrB,GAAG,IAAI,CAAC,QAAQ,gFAAgF,CACjG,CAAC;gBACJ,CAAC;gBACD,IAAI,cAAc,EAAE,CAAC;oBACnB,6DAA6D;oBAC7D,8DAA8D;oBAC9D,8DAA8D;oBAC9D,oCAAoC;oBACpC,OAAO,gBAAgB,CACrB,GAAG,IAAI,CAAC,QAAQ,gFAAgF,CACjG,CAAC;gBACJ,CAAC;gBACD,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACzD,OAAO,gBAAgB,CAAC,GAAG,IAAI,CAAC,QAAQ,4CAA4C,CAAC,CAAC;YACxF,CAAC;YAED,OAAO,gBAAgB,CAAC,GAAG,IAAI,CAAC,QAAQ,oBAAoB,EAAE,OAAO,CAAC,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/origins.d.ts

@@ -0,0 +1,72 @@
+/**
+ * The origin-scope engine: which *sites* a browser action may be taken on
+ * unattended.
+ *
+ * `ToolRisk` classifies a tool, and that was too coarse for `browser.act`
+ * in the same way it is too coarse for a shell — but not for the same
+ * reason, and the difference is why this is a second engine rather than a
+ * second use of the first. A command string *is* a description of its
+ * effect, so `analyzeCommand` can tell `git status` from `rm -rf`. A CSS
+ * selector is not: `click("#submit")` is equally "load more results" and
+ * "confirm purchase", and a scope written over selectors would mean
+ * nothing at all.
+ *
+ * What is left that an operator can read is *where* the click lands. So a
+ * scope here is one origin — `https://app.example.com`, exactly, scheme
+ * and host and port — taken from the page the conversation is already on
+ * rather than from anything the call said about itself.
+ *
+ * **This narrows the blast radius; it does not eliminate it.** Acting on
+ * `app.example.com` still covers "delete the record" alongside "load more".
+ * The claim is only that the radius is now nameable, which is what a
+ * single `dangerous` tier gave up on — and the docs say it in those words
+ * rather than implying a click became safe.
+ *
+ * There is deliberately no built-in safe list here, which is the other
+ * asymmetry with the command engine. `SAFE_COMMAND_SCOPES` can exist
+ * because `git status` is read-only wherever it runs; no origin has that
+ * property, since whether clicking on a site is harmless is a fact about
+ * the operator's account on it rather than about the site. A first-party
+ * list would be this project guessing at somebody's permissions, so every
+ * origin an agent may act on unattended was granted by a person — at a
+ * prompt, in Slack, or by hand in that agent's whitelist file.
+ */
+/** One narrow permission to act on a site: an origin, and nothing else. */
+export interface OriginScope {
+    /**
+     * `https://app.example.com`, or `https://app.example.com:8443` when the
+     * port is not the scheme's default — the form `originOf` produces, which
+     * is the only form this engine ever compares.
+     */
+    origin: string;
+}
+/**
+ * The scope a page URL grants, or nothing when the URL has no origin this
+ * engine will name (`about:blank`, a `file:` path, an unparseable string).
+ *
+ * Nothing falls back to a looser grant: a page whose origin cannot be
+ * named is a page no scope covers, so the call asks a human and an
+ * "always" answered on it is remembered for that call only.
+ */
+export declare const originScopeFor: (rawUrl: string) => OriginScope | undefined;
+/** Whether an action on `origin` falls inside one scope. */
+export declare const matchesOriginScope: (origin: string, scope: OriginScope) => boolean;
+/** The first scope covering this origin, if any covers it. */
+export declare const findMatchingOriginScope: (origin: string, scopes: readonly OriginScope[]) => OriginScope | undefined;
+/** One line an operator can read in a log or a grant listing. */
+export declare const describeOriginScope: (scope: OriginScope) => string;
+/** Whether two scopes permit the same thing, so a whitelist does not grow duplicates. */
+export declare const sameOriginScope: (left: OriginScope, right: OriginScope) => boolean;
+/**
+ * Read one scope out of a whitelist file, or refuse it.
+ *
+ * Re-normalized through `originScopeFor` rather than trusted as written,
+ * because this file is hand-editable and a grant is only as good as the
+ * comparison it will lose or win. `https://APP.example.com/reports` in the
+ * file becomes `https://app.example.com` or it is dropped — a trailing
+ * path that silently never matched would read as a grant and behave as
+ * none, and a second spelling of an approved host is a second grant nobody
+ * wrote.
+ */
+export declare const parseOriginScope: (raw: unknown) => OriginScope | undefined;
+//# sourceMappingURL=origins.d.ts.map

package/dist/origins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origins.d.ts","sourceRoot":"","sources":["../src/origins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAAI,QAAQ,MAAM,KAAG,WAAW,GAAG,SAG7D,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,EAAE,OAAO,WAAW,KAAG,OAC/C,CAAC;AAE1B,8DAA8D;AAC9D,eAAO,MAAM,uBAAuB,GAClC,QAAQ,MAAM,EACd,QAAQ,SAAS,WAAW,EAAE,KAC7B,WAAW,GAAG,SAAsE,CAAC;AAExF,iEAAiE;AACjE,eAAO,MAAM,mBAAmB,GAAI,OAAO,WAAW,KAAG,MAAsB,CAAC;AAEhF,yFAAyF;AACzF,eAAO,MAAM,eAAe,GAAI,MAAM,WAAW,EAAE,OAAO,WAAW,KAAG,OAC1C,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,GAAI,KAAK,OAAO,KAAG,WAAW,GAAG,SAM7D,CAAC"}

package/dist/origins.js

@@ -0,0 +1,73 @@
+/**
+ * The origin-scope engine: which *sites* a browser action may be taken on
+ * unattended.
+ *
+ * `ToolRisk` classifies a tool, and that was too coarse for `browser.act`
+ * in the same way it is too coarse for a shell — but not for the same
+ * reason, and the difference is why this is a second engine rather than a
+ * second use of the first. A command string *is* a description of its
+ * effect, so `analyzeCommand` can tell `git status` from `rm -rf`. A CSS
+ * selector is not: `click("#submit")` is equally "load more results" and
+ * "confirm purchase", and a scope written over selectors would mean
+ * nothing at all.
+ *
+ * What is left that an operator can read is *where* the click lands. So a
+ * scope here is one origin — `https://app.example.com`, exactly, scheme
+ * and host and port — taken from the page the conversation is already on
+ * rather than from anything the call said about itself.
+ *
+ * **This narrows the blast radius; it does not eliminate it.** Acting on
+ * `app.example.com` still covers "delete the record" alongside "load more".
+ * The claim is only that the radius is now nameable, which is what a
+ * single `dangerous` tier gave up on — and the docs say it in those words
+ * rather than implying a click became safe.
+ *
+ * There is deliberately no built-in safe list here, which is the other
+ * asymmetry with the command engine. `SAFE_COMMAND_SCOPES` can exist
+ * because `git status` is read-only wherever it runs; no origin has that
+ * property, since whether clicking on a site is harmless is a fact about
+ * the operator's account on it rather than about the site. A first-party
+ * list would be this project guessing at somebody's permissions, so every
+ * origin an agent may act on unattended was granted by a person — at a
+ * prompt, in Slack, or by hand in that agent's whitelist file.
+ */
+import { originOf } from '@stratusagent/core';
+/**
+ * The scope a page URL grants, or nothing when the URL has no origin this
+ * engine will name (`about:blank`, a `file:` path, an unparseable string).
+ *
+ * Nothing falls back to a looser grant: a page whose origin cannot be
+ * named is a page no scope covers, so the call asks a human and an
+ * "always" answered on it is remembered for that call only.
+ */
+export const originScopeFor = (rawUrl) => {
+    const origin = originOf(rawUrl);
+    return origin === undefined ? undefined : { origin };
+};
+/** Whether an action on `origin` falls inside one scope. */
+export const matchesOriginScope = (origin, scope) => scope.origin === origin;
+/** The first scope covering this origin, if any covers it. */
+export const findMatchingOriginScope = (origin, scopes) => scopes.find((scope) => matchesOriginScope(origin, scope));
+/** One line an operator can read in a log or a grant listing. */
+export const describeOriginScope = (scope) => scope.origin;
+/** Whether two scopes permit the same thing, so a whitelist does not grow duplicates. */
+export const sameOriginScope = (left, right) => left.origin === right.origin;
+/**
+ * Read one scope out of a whitelist file, or refuse it.
+ *
+ * Re-normalized through `originScopeFor` rather than trusted as written,
+ * because this file is hand-editable and a grant is only as good as the
+ * comparison it will lose or win. `https://APP.example.com/reports` in the
+ * file becomes `https://app.example.com` or it is dropped — a trailing
+ * path that silently never matched would read as a grant and behave as
+ * none, and a second spelling of an approved host is a second grant nobody
+ * wrote.
+ */
+export const parseOriginScope = (raw) => {
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
+        return undefined;
+    }
+    const origin = raw.origin;
+    return typeof origin === 'string' ? originScopeFor(origin) : undefined;
+};
+//# sourceMappingURL=origins.js.map

package/dist/origins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origins.js","sourceRoot":"","sources":["../src/origins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAY9C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAc,EAA2B,EAAE;IACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;AACvD,CAAC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAAE,KAAkB,EAAW,EAAE,CAChF,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC;AAE1B,8DAA8D;AAC9D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,MAAc,EACd,MAA8B,EACL,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAExF,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAkB,EAAU,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;AAEhF,yFAAyF;AACzF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAiB,EAAE,KAAkB,EAAW,EAAE,CAChF,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAY,EAA2B,EAAE;IACxE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAI,GAA+B,CAAC,MAAM,CAAC;IACvD,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC,CAAC"}