@superblocksteam/vite-plugin-file-sync 1.99.99-next.3 → 2.0.0-SNAPSHOT.2143e2e95d0107ab

package/dist/ai-service/agent/tools/integrations/sql-classification.js

@@ -0,0 +1,570 @@
+import { loadModule, parseSync } from "libpg-query";
+import { LakebasePlugin, PostgresPlugin, SnowflakePostgresPlugin, } from "@superblocksteam/shared";
+import { getLogger } from "../../../../util/logger.js";
+/**
+ * The fail-closed answer: the query could not be understood, so it is not
+ * treated as a read and no row-limit claim is made about it.
+ */
+const UNCLASSIFIED = {
+    changesSchema: false,
+    kind: "unknown",
+    supportsRowLimit: false,
+    returnsRows: false,
+};
+/**
+ * Plugins whose queries the PostgreSQL grammar can parse. Everything else falls
+ * back to keyword screening, which can only tell a read from a non-read.
+ *
+ * These all run an actual PostgreSQL engine, so the grammar is exact.
+ * CockroachDB is deliberately absent: it speaks the Postgres wire protocol but
+ * accepts syntax the Postgres grammar rejects, so parsing it would classify
+ * ordinary Cockroach reads such as `SELECT ... AS OF SYSTEM TIME '-1m'`,
+ * `SHOW RANGES FROM TABLE t`, and index hints like `FROM users@idx` as
+ * `unknown` and block queries that work today.
+ */
+const POSTGRES_FAMILY_PLUGIN_IDS = new Set([
+    LakebasePlugin.id,
+    PostgresPlugin.id,
+    SnowflakePostgresPlugin.id,
+]);
+/** Top-level statement kinds that write rows. */
+const MUTATION_STATEMENT_KEYS = new Set([
+    "DeleteStmt",
+    "InsertStmt",
+    "MergeStmt",
+    "UpdateStmt",
+]);
+/** Top-level statement kinds that change database objects. */
+const DDL_STATEMENT_KEYS = new Set([
+    "AlterSeqStmt",
+    "AlterTableStmt",
+    "CommentStmt",
+    "CreateSchemaStmt",
+    "CreateSeqStmt",
+    "CreateStmt",
+    "CreateTableAsStmt",
+    "DropStmt",
+    "IndexStmt",
+    "RenameStmt",
+    "TruncateStmt",
+    "ViewStmt",
+]);
+/**
+ * The object classes a DDL statement may name.
+ *
+ * Postgres uses one AST node per operation, not per object: every `DROP` is a
+ * `DropStmt` and every `RENAME` is a `RenameStmt`, whatever they act on. So
+ * `DROP TABLE`, `DROP POLICY` and `DROP FUNCTION` are the same node, and the
+ * object class is the only thing separating a table change from removing a
+ * row-level-security policy or an audit trigger. Approving "DDL" must not also
+ * approve those.
+ */
+const DDL_OBJECT_CLASSES = new Set([
+    "OBJECT_COLUMN",
+    "OBJECT_INDEX",
+    "OBJECT_MATVIEW",
+    "OBJECT_SCHEMA",
+    "OBJECT_SEQUENCE",
+    "OBJECT_TABCONSTRAINT",
+    "OBJECT_TABLE",
+    "OBJECT_VIEW",
+]);
+/**
+ * The field naming the object class, per statement node that shares one node
+ * across object classes. Nodes absent here name only one kind of object, so
+ * the node key alone already says what they touch.
+ */
+const DDL_OBJECT_CLASS_FIELDS = new Map([
+    ["AlterTableStmt", "objtype"],
+    ["CommentStmt", "objtype"],
+    ["DropStmt", "removeType"],
+    ["RenameStmt", "renameType"],
+]);
+/**
+ * The `ALTER TABLE` subcommands that change a table's shape.
+ *
+ * Naming a table is not enough to make an `ALTER TABLE` safe. The statement
+ * carries a list of subcommands, and some of them change access control
+ * rather than shape: `DISABLE ROW LEVEL SECURITY` drops a row-filtering
+ * policy's effect, `DISABLE TRIGGER` silences an audit trigger, and `OWNER TO`
+ * hands the table to another role. Those belong with the privilege statements
+ * this tool rejects, so the list is an allowlist of shape changes and anything
+ * else is refused. Row-level security appears in neither direction: turning it
+ * on or off is an access-control change, not a schema change.
+ */
+const ALTER_TABLE_SHAPE_SUBCOMMANDS = new Set([
+    "AT_AddColumn",
+    "AT_AddConstraint",
+    "AT_AddIdentity",
+    "AT_AlterColumnType",
+    "AT_AttachPartition",
+    "AT_ClusterOn",
+    "AT_ColumnDefault",
+    "AT_DetachPartition",
+    "AT_DropColumn",
+    "AT_DropCluster",
+    "AT_DropConstraint",
+    "AT_DropExpression",
+    "AT_DropIdentity",
+    "AT_DropNotNull",
+    "AT_SetAccessMethod",
+    "AT_SetCompression",
+    "AT_SetExpression",
+    "AT_SetIdentity",
+    "AT_SetLogged",
+    "AT_SetNotNull",
+    "AT_SetStatistics",
+    "AT_SetStorage",
+    "AT_SetUnLogged",
+    "AT_ValidateConstraint",
+]);
+/** Top-level statement kinds that only read. */
+const READ_STATEMENT_KEYS = new Set([
+    "SelectStmt",
+    "VariableShowStmt",
+]);
+/**
+ * Keys that mean a read-shaped statement actually changes schema. `SELECT ...
+ * INTO newtable` parses as an ordinary `SelectStmt` carrying an `intoClause`,
+ * but it creates a table.
+ */
+const NESTED_DDL_KEYS = new Set(["intoClause"]);
+/**
+ * Keys that mean a read-shaped statement actually writes or locks rows.
+ *
+ * These are matched anywhere in the statement subtree, not just at the top
+ * level, because a data-modifying CTE parses as a `SelectStmt` with the
+ * `InsertStmt` buried in its `withClause`. Checking only the top-level kind
+ * classifies `WITH x AS (INSERT ...) SELECT * FROM x` as a plain read and lets
+ * it execute unapproved. `lockingClause` is here because `SELECT ... FOR UPDATE`
+ * takes row locks and deserves the same approval as a write.
+ */
+const NESTED_MUTATION_KEYS = new Set([
+    ...MUTATION_STATEMENT_KEYS,
+    "lockingClause",
+]);
+/**
+ * Statements that stay blocked even nested inside an allowed DDL statement.
+ *
+ * `CREATE SCHEMA` takes a list of schema elements, and the grammar allows
+ * `GRANT` and `CREATE TRIGGER` among them. Those are one statement with the
+ * `CREATE SCHEMA`, so classifying by the top-level node alone lets a privilege
+ * grant ride along on an approval written for creating a schema.
+ */
+const NESTED_BLOCKED_KEYS = new Set([
+    "CreatePolicyStmt",
+    "CreateTrigStmt",
+    "GrantRoleStmt",
+    "GrantStmt",
+]);
+/**
+ * Keywords that block a query on dialects with no parser. Preserves the
+ * screening this tool has always applied, so those integrations keep their
+ * existing read-only behavior.
+ */
+const UNPARSED_DIALECT_WRITE_KEYWORDS = [
+    "ALTER",
+    "COPY",
+    "CREATE",
+    "DELETE",
+    "DROP",
+    "GRANT",
+    "INSERT",
+    "MERGE",
+    "RENAME",
+    "REPLACE",
+    "REVOKE",
+    "SET",
+    "TRUNCATE",
+    "UNSET",
+    "UPDATE",
+    "USE",
+    "VACUUM",
+];
+let parserReady;
+function ensureParserLoaded() {
+    if (parserReady === undefined) {
+        parserReady = loadModule().catch((error) => {
+            // Don't cache the failure; a later call should be able to retry.
+            parserReady = undefined;
+            throw error;
+        });
+    }
+    return parserReady;
+}
+/**
+ * Depth at which the walk gives up rather than risk exhausting the stack.
+ *
+ * Set well above real queries, because the parse tree is much deeper than the
+ * SQL looks: every chained binary operator adds several levels, so a hundred
+ * concatenated columns already runs to a few hundred. A tree past this bound is
+ * generated or adversarial, and rejecting it beats returning a verdict the walk
+ * never finished computing. Node's stack absorbs this depth comfortably.
+ */
+const MAX_AST_DEPTH = 1000;
+function containsKey(node, keys, depth = 0) {
+    if (depth > MAX_AST_DEPTH) {
+        throw new Error(`parse tree deeper than ${MAX_AST_DEPTH} levels`);
+    }
+    if (Array.isArray(node)) {
+        return node.some((child) => containsKey(child, keys, depth + 1));
+    }
+    if (node === null || typeof node !== "object") {
+        return false;
+    }
+    return Object.entries(node).some(([key, value]) => (keys.has(key) && carriesValue(value)) ||
+        containsKey(value, keys, depth + 1));
+}
+/**
+ * Whether a matched key actually says anything. libpg-query omits the fields a
+ * statement has no value for, so today a present `lockingClause` means a real
+ * `FOR UPDATE`. Relying on that is relying on a serialization detail of a
+ * caret-ranged dependency: a release that starts emitting `intoClause: null`
+ * and `lockingClause: []` on every plain SELECT would turn every read into a
+ * rejection. Checking the value instead of the key survives that.
+ */
+function carriesValue(value) {
+    if (value === null || value === undefined) {
+        return false;
+    }
+    return Array.isArray(value) ? value.length > 0 : true;
+}
+/**
+ * Pulls the statement nodes out of a libpg-query parse result. Returns
+ * undefined when the result has an unexpected shape, which callers treat as
+ * unparseable rather than trusting a partial read of it.
+ */
+function extractStatements(parsed) {
+    if (parsed === null || typeof parsed !== "object" || !("stmts" in parsed)) {
+        return undefined;
+    }
+    const { stmts } = parsed;
+    if (!Array.isArray(stmts)) {
+        return undefined;
+    }
+    const statements = [];
+    for (const entry of stmts) {
+        if (entry === null || typeof entry !== "object" || !("stmt" in entry)) {
+            return undefined;
+        }
+        const { stmt } = entry;
+        if (stmt === null || typeof stmt !== "object") {
+            return undefined;
+        }
+        statements.push(stmt);
+    }
+    return statements;
+}
+/** Reads an object-valued field off a parse node, or undefined if absent. */
+function nodeField(node, key) {
+    if (node === null || typeof node !== "object") {
+        return undefined;
+    }
+    const value = node[key];
+    return value !== null && typeof value === "object"
+        ? value
+        : undefined;
+}
+/**
+ * Whether an `EXPLAIN` carries the `ANALYZE` option, which makes it run the
+ * statement it is explaining instead of only planning it.
+ *
+ * `EXPLAIN (ANALYZE false)` is treated as running too. Reading the option's
+ * argument to prove otherwise buys nothing but a way to be wrong.
+ */
+function explainRunsStatement(explain) {
+    const { options } = explain;
+    if (!Array.isArray(options)) {
+        return false;
+    }
+    return options.some((option) => nodeField(option, "DefElem")
+        ?.defname === "analyze");
+}
+/**
+ * Classifies `EXPLAIN` by what it does to the database. A plain `EXPLAIN` only
+ * plans its statement, so it is a read no matter what it wraps; an `EXPLAIN
+ * ANALYZE` executes that statement and is exactly as dangerous as it is.
+ */
+function classifyExplain(explain) {
+    if (!explainRunsStatement(explain)) {
+        return "read";
+    }
+    const explained = nodeField(explain, "query");
+    // An ANALYZE whose target cannot be read is not assumed harmless.
+    return explained === undefined ? "unknown" : classifyStatement(explained);
+}
+/**
+ * Whether a DDL statement names an object class Clark may change.
+ *
+ * Fails closed when the class is missing or unrecognized: a parser release
+ * that renamed the field must reject the statement rather than wave through
+ * every `DROP` it can no longer identify.
+ */
+function targetsAllowedObjectClass(statement, statementKey) {
+    const field = DDL_OBJECT_CLASS_FIELDS.get(statementKey);
+    if (field === undefined) {
+        return true;
+    }
+    const body = nodeField(statement, statementKey);
+    if (body === undefined) {
+        return false;
+    }
+    const objectClass = Reflect.get(body, field);
+    return typeof objectClass === "string" && DDL_OBJECT_CLASSES.has(objectClass);
+}
+function classifyStatement(statement) {
+    const [statementKey] = Object.keys(statement);
+    if (statementKey === undefined) {
+        return "unknown";
+    }
+    if (statementKey === "ExplainStmt") {
+        const explain = nodeField(statement, statementKey);
+        return explain === undefined ? "unknown" : classifyExplain(explain);
+    }
+    if (MUTATION_STATEMENT_KEYS.has(statementKey)) {
+        return "data_mutation";
+    }
+    if (DDL_STATEMENT_KEYS.has(statementKey)) {
+        return classifyDdl(statement, statementKey);
+    }
+    if (READ_STATEMENT_KEYS.has(statementKey)) {
+        // A mutation outranks the `intoClause` that makes this DDL: `WITH x AS
+        // (INSERT ...) SELECT * INTO y FROM x` both creates a table and writes
+        // rows, and the write is the part that needs saying.
+        if (containsKey(statement, NESTED_MUTATION_KEYS)) {
+            return "data_mutation";
+        }
+        return containsKey(statement, NESTED_DDL_KEYS) ? "ddl" : "read";
+    }
+    return "schema_or_session";
+}
+function statementChangesSchema(statement) {
+    const [statementKey] = Object.keys(statement);
+    if (statementKey === undefined) {
+        return false;
+    }
+    if (statementKey === "ExplainStmt") {
+        const explain = nodeField(statement, statementKey);
+        if (explain === undefined || !explainRunsStatement(explain)) {
+            return false;
+        }
+        const explained = nodeField(explain, "query");
+        return explained !== undefined && statementChangesSchema(explained);
+    }
+    return (DDL_STATEMENT_KEYS.has(statementKey) ||
+        containsKey(statement, NESTED_DDL_KEYS));
+}
+/**
+ * Whether every subcommand of an `ALTER TABLE` only changes the table's shape.
+ *
+ * Subcommands are a list, so a statement that reads as "add a column" can
+ * carry a blocked one alongside it: `ALTER TABLE users ADD COLUMN email text,
+ * DISABLE ROW LEVEL SECURITY` is a single statement. Fails closed on a
+ * subcommand list it cannot read.
+ */
+function changesOnlyTableShape(statement) {
+    const body = nodeField(statement, "AlterTableStmt");
+    if (body === undefined) {
+        return false;
+    }
+    const commands = Reflect.get(body, "cmds");
+    if (!Array.isArray(commands)) {
+        return false;
+    }
+    return commands.every((command) => {
+        const cmd = nodeField(command, "AlterTableCmd") ?? {};
+        // CASCADE is stored on the subcommand, not the ALTER TABLE node.
+        // `DROP COLUMN email CASCADE` would otherwise pass as a shape change
+        // and drop every dependent view and foreign key.
+        if (Reflect.get(cmd, "behavior") === "DROP_CASCADE") {
+            return false;
+        }
+        const subtype = Reflect.get(cmd, "subtype");
+        return (typeof subtype === "string" && ALTER_TABLE_SHAPE_SUBCOMMANDS.has(subtype));
+    });
+}
+/**
+ * Narrows an allowed DDL node by what it actually does. The node key says a
+ * statement changes database objects; it does not say which objects, which
+ * parts of them, nor whether the statement smuggles a blocked operation in a
+ * nested clause.
+ */
+function classifyDdl(statement, statementKey) {
+    if (!targetsAllowedObjectClass(statement, statementKey) ||
+        containsKey(statement, NESTED_BLOCKED_KEYS)) {
+        return "schema_or_session";
+    }
+    if (statementKey === "AlterTableStmt" && !changesOnlyTableShape(statement)) {
+        return "schema_or_session";
+    }
+    if (statementKey === "ViewStmt") {
+        const body = nodeField(statement, statementKey);
+        // Relation options on CREATE VIEW (`WITH (security_barrier = false)`)
+        // are the same access-control knobs blocked on ALTER VIEW SET/RESET.
+        if (body === undefined || carriesValue(Reflect.get(body, "options"))) {
+            return "schema_or_session";
+        }
+    }
+    if (statementKey === "CreateSchemaStmt") {
+        const body = nodeField(statement, statementKey);
+        if (body === undefined || Reflect.has(body, "authrole")) {
+            return "schema_or_session";
+        }
+    }
+    if ((statementKey === "DropStmt" || statementKey === "TruncateStmt") &&
+        Reflect.get(nodeField(statement, statementKey) ?? {}, "behavior") ===
+            "DROP_CASCADE") {
+        return "schema_or_session";
+    }
+    // `CREATE TABLE AS` accepts a data-modifying CTE, so DDL can carry a write.
+    return containsKey(statement, NESTED_MUTATION_KEYS) ? "data_mutation" : "ddl";
+}
+/**
+ * Whether a statement hands back rows. A `SELECT` always does. A mutation does
+ * only when it carries `RETURNING`, which libpg-query surfaces as a
+ * `returningList` field that is absent otherwise.
+ */
+function statementReturnsRows(statement) {
+    const [statementKey] = Object.keys(statement);
+    if (statementKey === undefined) {
+        return false;
+    }
+    if (statementKey === "SelectStmt") {
+        return true;
+    }
+    if (!MUTATION_STATEMENT_KEYS.has(statementKey)) {
+        return false;
+    }
+    const body = nodeField(statement, statementKey);
+    return body !== undefined && "returningList" in body;
+}
+function classifyWithoutParser(query) {
+    const normalizedQuery = query.trim().toUpperCase();
+    const hasWriteKeyword = UNPARSED_DIALECT_WRITE_KEYWORDS.some((keyword) => 
+    // Match the keyword at the start, or after whitespace, a semicolon, or
+    // an opening paren so `WITH x AS (DELETE ...)` cannot screen as a read.
+    new RegExp(`(^|[\\s;(])${keyword}\\s`, "i").test(normalizedQuery));
+    return hasWriteKeyword
+        ? {
+            changesSchema: false,
+            kind: "unsupported_dialect",
+            supportsRowLimit: false,
+            returnsRows: false,
+        }
+        : {
+            changesSchema: false,
+            kind: "read",
+            supportsRowLimit: true,
+            returnsRows: true,
+        };
+}
+async function classifyWithParser(query) {
+    try {
+        await ensureParserLoaded();
+    }
+    catch (error) {
+        // A parser that will not load is an outage, not a malformed query, and it
+        // rejects every Postgres query until it is fixed. `unknown` alone cannot
+        // tell an operator which of the two is happening, so say it out loud.
+        getLogger().warn("SQL classifier unavailable, rejecting the query", error);
+        return UNCLASSIFIED;
+    }
+    let parsed;
+    try {
+        parsed = parseSync(query);
+    }
+    catch {
+        // Unparseable input is never assumed safe. This is the ordinary path for a
+        // malformed or non-Postgres query, so it is not worth logging.
+        return UNCLASSIFIED;
+    }
+    const statements = extractStatements(parsed);
+    const [statement] = statements ?? [];
+    // The tool contract permits one statement. A batch cannot share one
+    // permission decision or one row-limit verdict safely, even if every
+    // individual statement parses.
+    if (statement === undefined || statements?.length !== 1) {
+        return UNCLASSIFIED;
+    }
+    try {
+        // `SELECT ... INTO t` is a SELECT that creates a table: it reports a row
+        // count, not rows, and the rows it selects become the table's contents.
+        // Demanding a `LIMIT` there rejects the natural form and makes the
+        // "corrected" one silently wrong, because `SELECT * INTO archive FROM
+        // users LIMIT 10` copies ten rows instead of the table. `CREATE TABLE AS`
+        // is the same operation and is already exempt, having its own node key.
+        const createsTable = containsKey(statement, NESTED_DDL_KEYS);
+        return {
+            changesSchema: statementChangesSchema(statement),
+            kind: classifyStatement(statement),
+            // A top-level SELECT is the only shape that can carry a LIMIT clause.
+            supportsRowLimit: !createsTable && Object.keys(statement).includes("SelectStmt"),
+            returnsRows: !createsTable && statementReturnsRows(statement),
+        };
+    }
+    catch (error) {
+        // An AST shape this walk does not expect, or one deep enough to exhaust the
+        // stack, must not escape as a thrown error: the call site treats a throw as
+        // a tool failure rather than a rejection, which would skip the gate.
+        getLogger().warn("SQL classifier could not walk the parse tree", error);
+        return UNCLASSIFIED;
+    }
+}
+/**
+ * The registry calls `getRequiredPermissions` several times per tool call and
+ * requires it to stay cheap, so results are memoized. Bounded because query
+ * text is unbounded.
+ */
+const CLASSIFICATION_CACHE_LIMIT = 64;
+const classificationCache = new Map();
+function cacheKey(query, pluginId) {
+    return `${pluginId ?? ""}\u0000${query}`;
+}
+function rememberClassification(key, classification) {
+    // `unknown` is the answer both for a query the grammar rejects and for a
+    // parser that failed to load. Caching it would let one transient WASM load
+    // failure reject that exact query for the life of the process, defeating the
+    // retry `ensureParserLoaded` is built for. Re-deriving it costs a parse of a
+    // query that is being rejected anyway.
+    if (classification.kind === "unknown") {
+        return classification;
+    }
+    if (classificationCache.size >= CLASSIFICATION_CACHE_LIMIT) {
+        const oldestKey = classificationCache.keys().next().value;
+        if (oldestKey !== undefined) {
+            classificationCache.delete(oldestKey);
+        }
+    }
+    classificationCache.set(key, classification);
+    return classification;
+}
+/**
+ * Classifies a SQL query so callers can decide whether it may run, and whether
+ * it needs approval first.
+ *
+ * Postgres-family integrations are parsed with the real PostgreSQL grammar.
+ * Every other dialect is keyword-screened and can only ever come back as a read
+ * or as `unsupported_dialect`; writes are not enabled for those integrations.
+ */
+export async function classifySqlStatement(query, pluginId) {
+    const key = cacheKey(query, pluginId);
+    const cached = classificationCache.get(key);
+    if (cached !== undefined) {
+        return cached;
+    }
+    const classification = pluginId === undefined || !POSTGRES_FAMILY_PLUGIN_IDS.has(pluginId)
+        ? classifyWithoutParser(query)
+        : await classifyWithParser(query);
+    return rememberClassification(key, classification);
+}
+/**
+ * Reads an already-computed classification without awaiting the parser.
+ *
+ * Only for callers that cannot be async and can tolerate a miss, such as
+ * picking the verb for an approval dialog. Never use it to decide whether a
+ * query may run — a miss looks identical to a read.
+ */
+export function peekSqlClassification(query, pluginId) {
+    return classificationCache.get(cacheKey(query, pluginId));
+}
+//# sourceMappingURL=sql-classification.js.map

package/dist/ai-service/agent/tools/integrations/sql-classification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-classification.js","sourceRoot":"","sources":["../../../../../src/ai-service/agent/tools/integrations/sql-classification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,EACL,cAAc,EACd,cAAc,EACd,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AA0CvD;;;GAGG;AACH,MAAM,YAAY,GAAsB;IACtC,aAAa,EAAE,KAAK;IACpB,IAAI,EAAE,SAAS;IACf,gBAAgB,EAAE,KAAK;IACvB,WAAW,EAAE,KAAK;CACnB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAAC;IAC9D,cAAc,CAAC,EAAE;IACjB,cAAc,CAAC,EAAE;IACjB,uBAAuB,CAAC,EAAE;CAC3B,CAAC,CAAC;AAEH,iDAAiD;AACjD,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAC3D,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,YAAY;CACb,CAAC,CAAC;AAEH,8DAA8D;AAC9D,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IACtD,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,kBAAkB;IAClB,eAAe;IACf,YAAY;IACZ,mBAAmB;IACnB,UAAU;IACV,WAAW;IACX,YAAY;IACZ,cAAc;IACd,UAAU;CACX,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IACtD,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,eAAe;IACf,iBAAiB;IACjB,sBAAsB;IACtB,cAAc;IACd,aAAa;CACd,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,uBAAuB,GAAgC,IAAI,GAAG,CAAC;IACnE,CAAC,gBAAgB,EAAE,SAAS,CAAC;IAC7B,CAAC,aAAa,EAAE,SAAS,CAAC;IAC1B,CAAC,UAAU,EAAE,YAAY,CAAC;IAC1B,CAAC,YAAY,EAAE,YAAY,CAAC;CAC7B,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,6BAA6B,GAAwB,IAAI,GAAG,CAAC;IACjE,cAAc;IACd,kBAAkB;IAClB,gBAAgB;IAChB,oBAAoB;IACpB,oBAAoB;IACpB,cAAc;IACd,kBAAkB;IAClB,oBAAoB;IACpB,eAAe;IACf,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;IAChB,oBAAoB;IACpB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,kBAAkB;IAClB,eAAe;IACf,gBAAgB;IAChB,uBAAuB;CACxB,CAAC,CAAC;AAEH,gDAAgD;AAChD,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IACvD,YAAY;IACZ,kBAAkB;CACnB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;AAErE;;;;;;;;;GASG;AACH,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IACxD,GAAG,uBAAuB;IAC1B,eAAe;CAChB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IACvD,kBAAkB;IAClB,gBAAgB;IAChB,eAAe;IACf,WAAW;CACZ,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,+BAA+B,GAAG;IACtC,OAAO;IACP,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,KAAK;IACL,UAAU;IACV,OAAO;IACP,QAAQ;IACR,KAAK;IACL,QAAQ;CACT,CAAC;AAEF,IAAI,WAAsC,CAAC;AAE3C,SAAS,kBAAkB;IACzB,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,WAAW,GAAG,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAClD,iEAAiE;YACjE,WAAW,GAAG,SAAS,CAAC;YACxB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,SAAS,WAAW,CAClB,IAAa,EACb,IAAyB,EACzB,KAAK,GAAG,CAAC;IAET,IAAI,KAAK,GAAG,aAAa,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,0BAA0B,aAAa,SAAS,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAC9B,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACf,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;QACtC,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CACtC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,MAAe;IACxC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,EAAE,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,EAAE,CAAC;YACtE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;QACvB,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,6EAA6E;AAC7E,SAAS,SAAS,CAAC,IAAa,EAAE,GAAW;IAC3C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAI,IAAgC,CAAC,GAAG,CAAC,CAAC;IACrD,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAChD,CAAC,CAAE,KAAgB;QACnB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,OAAe;IAC3C,MAAM,EAAE,OAAO,EAAE,GAAG,OAAgC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CACjB,CAAC,MAAM,EAAE,EAAE,CACR,SAAS,CAAC,MAAM,EAAE,SAAS,CAAuC;QACjE,EAAE,OAAO,KAAK,SAAS,CAC5B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,kEAAkE;IAClE,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAChC,SAAiB,EACjB,YAAoB;IAEpB,MAAM,KAAK,GAAG,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAChD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,WAAW,GAAY,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACtD,OAAO,OAAO,WAAW,KAAK,QAAQ,IAAI,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,YAAY,KAAK,aAAa,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACnD,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9C,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QACzC,OAAO,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC1C,uEAAuE;QACvE,uEAAuE;QACvE,qDAAqD;QACrD,IAAI,WAAW,CAAC,SAAS,EAAE,oBAAoB,CAAC,EAAE,CAAC;YACjD,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,OAAO,WAAW,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAClE,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,SAAS,sBAAsB,CAAC,SAAiB;IAC/C,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,YAAY,KAAK,aAAa,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACnD,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,SAAS,KAAK,SAAS,IAAI,sBAAsB,CAAC,SAAS,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,CACL,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC;QACpC,WAAW,CAAC,SAAS,EAAE,eAAe,CAAC,CACxC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,SAAiB;IAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAY,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE;QAChC,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,EAAE,CAAC;QACtD,iEAAiE;QACjE,qEAAqE;QACrE,iDAAiD;QACjD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,cAAc,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,OAAO,GAAY,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACrD,OAAO,CACL,OAAO,OAAO,KAAK,QAAQ,IAAI,6BAA6B,CAAC,GAAG,CAAC,OAAO,CAAC,CAC1E,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAClB,SAAiB,EACjB,YAAoB;IAEpB,IACE,CAAC,yBAAyB,CAAC,SAAS,EAAE,YAAY,CAAC;QACnD,WAAW,CAAC,SAAS,EAAE,mBAAmB,CAAC,EAC3C,CAAC;QACD,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,IAAI,YAAY,KAAK,gBAAgB,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3E,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAChD,sEAAsE;QACtE,qEAAqE;QACrE,IAAI,IAAI,KAAK,SAAS,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,mBAAmB,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,IAAI,YAAY,KAAK,kBAAkB,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAChD,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;YACxD,OAAO,mBAAmB,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,IACE,CAAC,YAAY,KAAK,UAAU,IAAI,YAAY,KAAK,cAAc,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE,UAAU,CAAC;YAC/D,cAAc,EAChB,CAAC;QACD,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,4EAA4E;IAC5E,OAAO,WAAW,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,SAAiB;IAC7C,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAChD,OAAO,IAAI,KAAK,SAAS,IAAI,eAAe,IAAI,IAAI,CAAC;AACvD,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,MAAM,eAAe,GAAG,+BAA+B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,IAAI,MAAM,CAAC,cAAc,OAAO,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAClE,CAAC;IAEF,OAAO,eAAe;QACpB,CAAC,CAAC;YACE,aAAa,EAAE,KAAK;YACpB,IAAI,EAAE,qBAAqB;YAC3B,gBAAgB,EAAE,KAAK;YACvB,WAAW,EAAE,KAAK;SACnB;QACH,CAAC,CAAC;YACE,aAAa,EAAE,KAAK;YACpB,IAAI,EAAE,MAAM;YACZ,gBAAgB,EAAE,IAAI;YACtB,WAAW,EAAE,IAAI;SAClB,CAAC;AACR,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAAa;IAC7C,IAAI,CAAC;QACH,MAAM,kBAAkB,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0EAA0E;QAC1E,yEAAyE;QACzE,sEAAsE;QACtE,SAAS,EAAE,CAAC,IAAI,CAAC,iDAAiD,EAAE,KAAK,CAAC,CAAC;QAC3E,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,+DAA+D;QAC/D,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,CAAC,SAAS,CAAC,GAAG,UAAU,IAAI,EAAE,CAAC;IACrC,oEAAoE;IACpE,qEAAqE;IACrE,+BAA+B;IAC/B,IAAI,SAAS,KAAK,SAAS,IAAI,UAAU,EAAE,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,IAAI,CAAC;QACH,yEAAyE;QACzE,wEAAwE;QACxE,mEAAmE;QACnE,sEAAsE;QACtE,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,YAAY,GAAG,WAAW,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QAC7D,OAAO;YACL,aAAa,EAAE,sBAAsB,CAAC,SAAS,CAAC;YAChD,IAAI,EAAE,iBAAiB,CAAC,SAAS,CAAC;YAClC,sEAAsE;YACtE,gBAAgB,EACd,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;YAChE,WAAW,EAAE,CAAC,YAAY,IAAI,oBAAoB,CAAC,SAAS,CAAC;SAC9D,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4EAA4E;QAC5E,4EAA4E;QAC5E,qEAAqE;QACrE,SAAS,EAAE,CAAC,IAAI,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAC;QACxE,OAAO,YAAY,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,0BAA0B,GAAG,EAAE,CAAC;AACtC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAA6B,CAAC;AAEjE,SAAS,QAAQ,CAAC,KAAa,EAAE,QAA4B;IAC3D,OAAO,GAAG,QAAQ,IAAI,EAAE,SAAS,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,sBAAsB,CAC7B,GAAW,EACX,cAAiC;IAEjC,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,uCAAuC;IACvC,IAAI,cAAc,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,IAAI,mBAAmB,CAAC,IAAI,IAAI,0BAA0B,EAAE,CAAC;QAC3D,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAC1D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC7C,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAa,EACb,QAA4B;IAE5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,cAAc,GAClB,QAAQ,KAAK,SAAS,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,QAAQ,CAAC;QACjE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC;QAC9B,CAAC,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAEtC,OAAO,sBAAsB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,QAA4B;IAE5B,OAAO,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC5D,CAAC"}

package/dist/ai-service/agent/tools/mark-api-manually-verified.d.ts

@@ -0,0 +1,31 @@
+import type { Clark } from "../../state-machine/clark-fsm.js";
+import type { ClarkStateHandlerParams } from "../../state-machine/clark-fsm.js";
+/**
+ * Records that the user manually verified a migrated API.
+ *
+ * The migration model lets the user opt out of automatic testing (write-policy
+ * "Don't test" or a `testApi` permission denial). Those APIs are marked
+ * `completed` with a skip reason and still surface as "needs manual
+ * verification" in the finalize modal. When the user clicks through the app
+ * themselves and tells Clark an API works, this tool stamps
+ * `verificationOutcome: "user_manually_verified"` so the API drops out of the
+ * untested list — without re-running `testApi` (which the user already opted
+ * out of).
+ */
+export declare const markApiManuallyVerifiedToolFactory: import("../tools2/types.js").ToolFactory<{
+    clark: Clark;
+    services: ClarkStateHandlerParams;
+}, import("../tools2/types.js").Tool<{
+    apiName: string;
+}, {
+    success: boolean;
+    apiName: string;
+    alreadyVerified: boolean;
+    message: string;
+} | {
+    success: boolean;
+    apiName: string;
+    message: string;
+    alreadyVerified?: undefined;
+}>>;
+//# sourceMappingURL=mark-api-manually-verified.d.ts.map

package/dist/ai-service/agent/tools/mark-api-manually-verified.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mark-api-manually-verified.d.ts","sourceRoot":"","sources":["../../../../src/ai-service/agent/tools/mark-api-manually-verified.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kCAAkC,CAAC;AAC9D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAShF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kCAAkC;WAMpC,KAAK;cACF,uBAAuB;;;;;;;;;;;;;GA2FpC,CAAC"}