@te-river/opencode-team-mode 1.6.1 → 1.7.0

package/dist/host/v2-guard.d.ts

@@ -22,6 +22,22 @@
  *     until `TM_R6_FINE_ASK=on` says otherwise.  A guard that fails open because
  *     we trusted an unproven hook is the opposite of this product.
  *
+ *  3. THE SHELL TIMEOUT CLAMP (issue #6), ported from the retired v1
+ *     `src/tm/bash-timeout.ts`.  The host's shell tool resolves
+ *     `flags.bashDefaultTimeoutMs ?? 2 * 60 * 1e3`, and a model that passes a
+ *     timeout at all passes 120000+ for a `Get-ChildItem` — three serialised
+ *     probes then cost the user six minutes of dead air for a reason no model
+ *     ever had.  v1 clamped it in a composed `tool.execute.before` hook; v2
+ *     gives the same mutable `input` to `tool.hook("execute.before")`, which is
+ *     where `applyV2BackgroundForce` already writes, so the protection is not
+ *     something the cut lost — it is the same lever at the same seam.
+ *     The discipline is unchanged and load-bearing: it clamps a number the
+ *     model ALREADY volunteered, never invents one it omitted, applies the
+ *     probe ceiling only to a command the P3 read-only allowlist accepts,
+ *     never rewrites the command, never widens what may run, and never throws
+ *     into the hook — a failure there means the call goes through untouched
+ *     and the attempt is counted.
+ *
  * The hook only ever makes a decision STRICTER (allow -> ask, anything -> deny on
  * a red line).  It never loosens what the host or the user's own rules chose.
  */
@@ -36,8 +52,48 @@ export interface GuardDecision {
 }
 /** The address question, asked of the host's native web path. */
 export declare function webGuard(resources: readonly string[]): GuardDecision | null;
+/**
+ * R6's FILE-PATH face.  v1 enforced this in a `tool.execute.before` hook factory
+ * (`createEnvProtectHook`) that was deleted with the v1 personality; v2 never
+ * picked it up, so a Team role could read `.env` through the native `read` tool
+ * while the docs claimed R6 covered "the environment or an env file".  The same
+ * classifier now rides `permission.hook("evaluate")`, whose `resources` carry the
+ * concrete path (live: `action:"read"` reaches evaluate with the real path).
+ *
+ * `isEnvFilePath` is the shared matcher and is already pattern-aware: it strips
+ * glob asterisks (so a `*.env` include is caught), cuts URL query tails, and
+ * refuses code identifiers like `process.env` — so an ordinary grep pattern
+ * (`TODO`) is never mistaken for a path.  `.env.example` and friends are
+ * checked-in templates and pass (see `ENV_TEMPLATE_SUFFIX`).
+ *
+ * A RED LINE, not a gate: v2 cannot raise a dialog, so there is no consent path
+ * to name — telling the agent to "ask for approval" would be a window that never
+ * appears.
+ */
+export declare function pathGuard(action: string, resources: readonly string[], mode: EnvProtectMode): GuardDecision | null;
 /** R6's env face and R2's danger face, per command line. */
 export declare function shellGuard(command: string | undefined, mode: EnvProtectMode): GuardDecision | null;
+/** One running child, as the concurrency refusal renders it. */
+export interface RunningChild {
+    sessionID: string;
+    agent?: string;
+    elapsedMs?: number;
+}
+/**
+ * The concurrency cap (#49 feature 2).  `permission.evaluate` fires for
+ * `subagent` (measured live: `guard_actions: … subagent=16 …`), so the cap is a
+ * HARD gate on the same seam as the env-file / address red lines — not a prompt
+ * hint a model can talk itself past.
+ *
+ * When the caller's OWN running children reach the cap, the next dispatch is
+ * denied with a Chinese, actionable refusal that names the running ids and the
+ * two ways out (collect with `tm_join`, or stop with `tm_join {cancel:true}`).
+ *
+ * Pure and total: `cap <= 0` disables it (never denies), an empty running list
+ * never denies, and it never throws.  Only ever stricter — the caller applies it
+ * through the same `rank` floor as every other guard.
+ */
+export declare function concurrencyGuard(action: string, running: readonly RunningChild[], cap: number): GuardDecision | null;
 export interface GuardReport {
     seen: number;
     byAction: Record<string, number>;
@@ -50,6 +106,31 @@ export interface GuardReport {
     /** evaluations skipped because the session belongs to a non-Team agent (#22) —
      *  the number that tells the user how much of this floor is not ours to hold */
     foreignSkipped: number;
+    /** file-path evaluations the R6 classifier flagged as an env file (read /
+     *  write / edit / glob / grep) — the evidence that the file-path face is
+     *  actually live, not just installed */
+    envFileDenied: number;
+    /** R6's file-path face caught at `execute.before`, where the FULL input is
+     *  visible — the seam `permission.evaluate` cannot cover for `grep`/`glob`,
+     *  whose resource is the PATTERN, not the search path (#58).  A separate
+     *  counter from `envFileDenied` on purpose: the two seams fail independently,
+     *  and one number for both would hide which one went dark. */
+    envFileDeniedByInput: number;
+    /** `execute.before` file-tool calls the input guard looked at (Team only). */
+    envFileInputSeen: number;
+    /** …skipped because the session is not ours (#22). */
+    envFileInputForeignSkipped: number;
+    /** …where the guard itself threw and the call was allowed through. */
+    envFileInputThrew: number;
+    /** #49 feature 2: `subagent` evaluations the concurrency cap looked at. */
+    concurrencySeen: number;
+    /** …where the cap fired and the dispatch was denied. */
+    concurrencyDenied: number;
+    /** The largest number of the caller's running children seen at one evaluation
+     *  — the peak the cap is measured against, so "we never hit it" is a number. */
+    concurrencyRunningMax: number;
+    /** …where the running-children read threw and the call was allowed through. */
+    concurrencyThrew: number;
 }
 export interface BackgroundForceReport {
     seen: number;
@@ -80,11 +161,49 @@ export declare function applyV2BackgroundForce(ctx: V2Context, opts?: {
 export declare function applyV2PermissionGuards(ctx: V2Context, opts: {
     envProtectMode: EnvProtectMode;
     scope?: TeamScope;
+    /** #49 feature 2: the caller's own running children, read from the plugin's
+     *  ONE children registry.  Absent = the cap is not enforced (a host with no
+     *  registry to read must not be denied on a guess). */
+    runningChildren?: (callerSessionID: string) => RunningChild[];
+    /** The cap.  `<= 0` disables it.  Defaults to 0 (off) so a caller that does
+     *  not opt in keeps the pre-#49 behaviour byte-exactly. */
+    maxConcurrent?: number;
+    /** Fired once per denial so the personality can write the `v2-concurrency`
+     *  trajectory line — the guard owns no store. */
+    onConcurrencyDenied?: (info: {
+        caller: string;
+        running: RunningChild[];
+        cap: number;
+    }) => void;
 }): Promise<{
     registrations: V2Registration[];
     report: GuardReport;
     installed: boolean;
 }>;
+/**
+ * R6's file-path face, on the seam that sees the WHOLE input (#58).
+ *
+ * `pathGuard` rides `permission.evaluate`, whose `resources` for `grep`/`glob`
+ * are the pattern — so the red line had a hole exactly the width of those two
+ * tools.  `execute.before` hands us the raw args the model sent, so the search
+ * path (`path` / `include` / `filePath`) is visible there and the same
+ * `isEnvFilePath` matcher can answer.
+ *
+ * A refusal is THROWN, not returned: `execute.before` has no `effect` field, and
+ * silently rewriting a path the model chose is the guesswork this product
+ * refuses — the model has to see the refusal.  Same shape as the browser gate's
+ * red line.  An internal failure is swallowed and counted (`envFileInputThrew`),
+ * never thrown into the host: a guard that cannot decide must not break the call
+ * it is inspecting.  Team-scoped through the same `scope.decide` gate as every
+ * other writer, and the counters land on `v2-surface` / `v2-shutdown`.
+ */
+export declare function applyV2EnvFileInputGuard(ctx: V2Context, opts: {
+    envProtectMode: EnvProtectMode;
+    scope?: TeamScope;
+    report: GuardReport;
+}): Promise<{
+    registrations: V2Registration[];
+}>;
 /** Does the config still need the coarse `shell -> ask` escalation?  Only while
  *  the fine path is switched off; with the classifier in charge, escalating every
  *  command would mask it.
@@ -98,4 +217,63 @@ export declare function applyV2PermissionGuards(ctx: V2Context, opts: {
  * An absent hook still forces coarse: no seam, no per-command judgement.
  */
 export declare function needsCoarseShellAsk(env: NodeJS.ProcessEnv, guardsInstalled: boolean): boolean;
+/** Parse the model-supplied timeout defensively: the host schema wants a positive
+ *  integer of milliseconds, but an LLM hands us `"120000"`, `120000.0`, or omits
+ *  it entirely.  Anything unreadable means "no timeout was supplied", and a
+ *  supplied-none is NEVER turned into one by us. */
+export declare function parseShellTimeout(raw: unknown): number | null;
+export type ShellTimeoutVerdict = {
+    changed: false;
+    via: "none" | "already-short";
+} | {
+    changed: true;
+    via: "probe" | "max";
+    from: number;
+    to: number;
+};
+/**
+ * Decide the clamped timeout for one shell call.  `probeMs` / `maxMs` of 0
+ * disable that ceiling.  `probeMs` applies ONLY to a command the P3 read-only
+ * allowlist already accepts; `maxMs` is the operator's explicit global cap and
+ * ships at 0 (off), because silently killing a build is worse than a slow one.
+ */
+export declare function resolveShellTimeout(opts: {
+    command: string;
+    timeoutMs: number | null;
+    probeMs: number;
+    maxMs: number;
+    readonlyAllowed: readonly string[];
+}): ShellTimeoutVerdict;
+export interface ShellTimeoutReport {
+    seen: number;
+    clamped: number;
+    /** clamps skipped because the session is not one of ours (#22) — a build
+     *  session's timeout is the host's business, not a plugin's */
+    foreignSkipped: number;
+    /** attempts that threw (including a classifier throw) and therefore
+     *  left the call byte-exact — counted so "the clamp is silent" is
+     *  distinguishable from "the clamp is broken" */
+    threw: number;
+}
+/**
+ * The `tool.hook("execute.before")` installation of the clamp.  Returns the
+ * registrations plus the counters that ride `v2-surface` / `v2-shutdown`.
+ * `onClamp` is how the caller writes the trajectory row; a throw inside it is
+ * swallowed there, never here.
+ */
+export declare function applyV2ShellTimeoutClamp(ctx: V2Context, opts: {
+    probeMs: number;
+    maxMs: number;
+    readonlyAllowed: readonly string[];
+    scope?: TeamScope;
+    onClamp?: (info: {
+        via: string;
+        from: number;
+        to: number;
+        sessionID?: string;
+    }) => void;
+}): Promise<{
+    registrations: V2Registration[];
+    report: ShellTimeoutReport;
+}>;
 //# sourceMappingURL=v2-guard.d.ts.map

package/dist/host/v2-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"v2-guard.d.ts","sourceRoot":"","sources":["../../src/host/v2-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE9D,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAA;IAChC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAA;CACZ;AAqBD,iEAAiE;AACjE,wBAAgB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,aAAa,GAAG,IAAI,CAyB3E;AAED,4DAA4D;AAC5D,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,cAAc,GAAG,aAAa,GAAG,IAAI,CAUlG;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd;;yDAEqD;IACrD,YAAY,EAAE,MAAM,CAAA;IACpB;oFACgF;IAChF,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,SAAS,EACd,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,SAAS,CAAA;CAAO,GAC/B,OAAO,CAAC;IAAE,aAAa,EAAE,cAAc,EAAE,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,CAAC,CAoB7E;AAED,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,SAAS,EACd,IAAI,EAAE;IAAE,cAAc,EAAE,cAAc,CAAC;IAAC,KAAK,CAAC,EAAE,SAAS,CAAA;CAAE,GAC1D,OAAO,CAAC;IAAE,aAAa,EAAE,cAAc,EAAE,CAAC;IAAC,MAAM,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC,CA0CvF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,eAAe,EAAE,OAAO,GAAG,OAAO,CAO7F"}
+{"version":3,"file":"v2-guard.d.ts","sourceRoot":"","sources":["../../src/host/v2-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE9D,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAA;IAChC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAA;CACZ;AAqBD,iEAAiE;AACjE,wBAAgB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,aAAa,GAAG,IAAI,CAyB3E;AAOD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,GAAG,aAAa,GAAG,IAAI,CAWlH;AAED,4DAA4D;AAC5D,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,cAAc,GAAG,aAAa,GAAG,IAAI,CAUlG;AAED,gEAAgE;AAChE,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,YAAY,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAepH;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd;;yDAEqD;IACrD,YAAY,EAAE,MAAM,CAAA;IACpB;oFACgF;IAChF,cAAc,EAAE,MAAM,CAAA;IACtB;;4CAEwC;IACxC,aAAa,EAAE,MAAM,CAAA;IACrB;;;;kEAI8D;IAC9D,oBAAoB,EAAE,MAAM,CAAA;IAC5B,8EAA8E;IAC9E,gBAAgB,EAAE,MAAM,CAAA;IACxB,sDAAsD;IACtD,0BAA0B,EAAE,MAAM,CAAA;IAClC,sEAAsE;IACtE,iBAAiB,EAAE,MAAM,CAAA;IACzB,2EAA2E;IAC3E,eAAe,EAAE,MAAM,CAAA;IACvB,wDAAwD;IACxD,iBAAiB,EAAE,MAAM,CAAA;IACzB;oFACgF;IAChF,qBAAqB,EAAE,MAAM,CAAA;IAC7B,+EAA+E;IAC/E,gBAAgB,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,SAAS,EACd,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,SAAS,CAAA;CAAO,GAC/B,OAAO,CAAC;IAAE,aAAa,EAAE,cAAc,EAAE,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,CAAC,CAoB7E;AAED,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,SAAS,EACd,IAAI,EAAE;IACJ,cAAc,EAAE,cAAc,CAAA;IAC9B,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB;;2DAEuD;IACvD,eAAe,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,YAAY,EAAE,CAAA;IAC7D;+DAC2D;IAC3D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;qDACiD;IACjD,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,YAAY,EAAE,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;CAC/F,GACA,OAAO,CAAC;IAAE,aAAa,EAAE,cAAc,EAAE,CAAC;IAAC,MAAM,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC,CAyEvF;AAuBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,SAAS,EACd,IAAI,EAAE;IAAE,cAAc,EAAE,cAAc,CAAC;IAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAC/E,OAAO,CAAC;IAAE,aAAa,EAAE,cAAc,EAAE,CAAA;CAAE,CAAC,CA8C9C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,eAAe,EAAE,OAAO,GAAG,OAAO,CAO7F;AAeD;;;oDAGoD;AACpD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAO7D;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAAA;CAAE,GACjD;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,OAAO,GAAG,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAA;AAErE;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC,GAAG,mBAAmB,CAQtB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf;mEAC+D;IAC/D,cAAc,EAAE,MAAM,CAAA;IACtB;;qDAEiD;IACjD,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,SAAS,EACd,IAAI,EAAE;IACJ,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;CACxF,GACA,OAAO,CAAC;IAAE,aAAa,EAAE,cAAc,EAAE,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,CAAC,CA8C1E"}

package/dist/host/v2-guard.js

@@ -22,11 +22,28 @@
  *     until `TM_R6_FINE_ASK=on` says otherwise.  A guard that fails open because
  *     we trusted an unproven hook is the opposite of this product.
  *
+ *  3. THE SHELL TIMEOUT CLAMP (issue #6), ported from the retired v1
+ *     `src/tm/bash-timeout.ts`.  The host's shell tool resolves
+ *     `flags.bashDefaultTimeoutMs ?? 2 * 60 * 1e3`, and a model that passes a
+ *     timeout at all passes 120000+ for a `Get-ChildItem` — three serialised
+ *     probes then cost the user six minutes of dead air for a reason no model
+ *     ever had.  v1 clamped it in a composed `tool.execute.before` hook; v2
+ *     gives the same mutable `input` to `tool.hook("execute.before")`, which is
+ *     where `applyV2BackgroundForce` already writes, so the protection is not
+ *     something the cut lost — it is the same lever at the same seam.
+ *     The discipline is unchanged and load-bearing: it clamps a number the
+ *     model ALREADY volunteered, never invents one it omitted, applies the
+ *     probe ceiling only to a command the P3 read-only allowlist accepts,
+ *     never rewrites the command, never widens what may run, and never throws
+ *     into the hook — a failure there means the call goes through untouched
+ *     and the attempt is counted.
+ *
  * The hook only ever makes a decision STRICTER (allow -> ask, anything -> deny on
  * a red line).  It never loosens what the host or the user's own rules chose.
  */
 import { R2_DANGER_BASH_ASK_PATTERNS, R6_ENV_BASH_ASK_PATTERNS, commandMatchesAnyAskPattern, isEnvFilePath, } from "../envprotect.js";
 import { classifyHost } from "../tm/egress.js";
+import { classifyReadonlyCommand } from "../tm/guard.js";
 const rank = { allow: 0, ask: 1, deny: 2 };
 /** A resource may be a full URL or a bare host; both have to be answered, since
  *  the host's own tool is free to hand us either shape. */
@@ -75,6 +92,43 @@ export function webGuard(resources) {
     }
     return null;
 }
+/** File tools whose path-class resources are scanned for env files.  `patch` is
+ *  deliberately absent: its resource shape has not been observed on a live host,
+ *  and guessing at a shape is how a guard either misses or misfires. */
+const PATH_GUARD_ACTIONS = new Set(["read", "write", "edit", "glob", "grep"]);
+/**
+ * R6's FILE-PATH face.  v1 enforced this in a `tool.execute.before` hook factory
+ * (`createEnvProtectHook`) that was deleted with the v1 personality; v2 never
+ * picked it up, so a Team role could read `.env` through the native `read` tool
+ * while the docs claimed R6 covered "the environment or an env file".  The same
+ * classifier now rides `permission.hook("evaluate")`, whose `resources` carry the
+ * concrete path (live: `action:"read"` reaches evaluate with the real path).
+ *
+ * `isEnvFilePath` is the shared matcher and is already pattern-aware: it strips
+ * glob asterisks (so a `*.env` include is caught), cuts URL query tails, and
+ * refuses code identifiers like `process.env` — so an ordinary grep pattern
+ * (`TODO`) is never mistaken for a path.  `.env.example` and friends are
+ * checked-in templates and pass (see `ENV_TEMPLATE_SUFFIX`).
+ *
+ * A RED LINE, not a gate: v2 cannot raise a dialog, so there is no consent path
+ * to name — telling the agent to "ask for approval" would be a window that never
+ * appears.
+ */
+export function pathGuard(action, resources, mode) {
+    if (mode === "off")
+        return null;
+    if (!PATH_GUARD_ACTIONS.has(action))
+        return null;
+    for (const raw of resources) {
+        const text = String(raw ?? "");
+        if (!text)
+            continue;
+        if (isEnvFilePath(text)) {
+            return { effect: "deny", why: "env-file-path", message: "R6 红线：这个路径指向环境文件（.env / shell rc 家族），不授权、不弹窗。" };
+        }
+    }
+    return null;
+}
 /** R6's env face and R2's danger face, per command line. */
 export function shellGuard(command, mode) {
     const text = String(command ?? "").trim();
@@ -88,6 +142,39 @@ export function shellGuard(command, mode) {
     }
     return null;
 }
+/**
+ * The concurrency cap (#49 feature 2).  `permission.evaluate` fires for
+ * `subagent` (measured live: `guard_actions: … subagent=16 …`), so the cap is a
+ * HARD gate on the same seam as the env-file / address red lines — not a prompt
+ * hint a model can talk itself past.
+ *
+ * When the caller's OWN running children reach the cap, the next dispatch is
+ * denied with a Chinese, actionable refusal that names the running ids and the
+ * two ways out (collect with `tm_join`, or stop with `tm_join {cancel:true}`).
+ *
+ * Pure and total: `cap <= 0` disables it (never denies), an empty running list
+ * never denies, and it never throws.  Only ever stricter — the caller applies it
+ * through the same `rank` floor as every other guard.
+ */
+export function concurrencyGuard(action, running, cap) {
+    if (action !== "subagent")
+        return null;
+    if (!Number.isFinite(cap) || cap <= 0)
+        return null;
+    if (running.length < cap)
+        return null;
+    const list = running
+        .map((c) => {
+        const secs = typeof c.elapsedMs === "number" && c.elapsedMs >= 0 ? ` 运行中 ${Math.round(c.elapsedMs / 1000)}s` : "";
+        return `${c.sessionID}${secs}`;
+    })
+        .join("、");
+    return {
+        effect: "deny",
+        why: "concurrency-cap",
+        message: `本会话已有 ${running.length} 个子代理在跑（上限 ${cap}）：${list}。先 tm_join 收取已结算的，或 tm_join {cancel:true} 停掉不需要的，再派新的。`,
+    };
+}
 /**
  * Every sub-agent dispatch runs in the background.
  *
@@ -131,7 +218,7 @@ export async function applyV2BackgroundForce(ctx, opts = {}) {
     return { registrations, report };
 }
 export async function applyV2PermissionGuards(ctx, opts) {
-    const report = { seen: 0, byAction: {}, strictened: 0, denied: 0, shellMatched: 0, foreignSkipped: 0 };
+    const report = { seen: 0, byAction: {}, strictened: 0, denied: 0, shellMatched: 0, foreignSkipped: 0, envFileDenied: 0, envFileDeniedByInput: 0, envFileInputSeen: 0, envFileInputForeignSkipped: 0, envFileInputThrew: 0, concurrencySeen: 0, concurrencyDenied: 0, concurrencyRunningMax: 0, concurrencyThrew: 0 };
     const permission = ctx.permission;
     if (!permission || typeof permission.hook !== "function") {
         return { registrations: [], report, installed: false };
@@ -154,19 +241,51 @@ export async function applyV2PermissionGuards(ctx, opts) {
                 ? webGuard(resources)
                 : action === "shell"
                     ? shellGuard(resources[0], opts.envProtectMode)
-                    : null;
-            if (!decision)
+                    : pathGuard(action, resources, opts.envProtectMode);
+            // #49 feature 2: the concurrency cap.  `permission.evaluate` fires for
+            // `subagent` (measured live), so this is a hard gate on the same seam as the
+            // red lines.  A read that throws is swallowed and counted — a throughput cap
+            // that fails OPEN is the honest failure mode, and it never loosens a host
+            // decision (the `rank` floor below still applies).
+            let concurrency = null;
+            if (action === "subagent") {
+                report.concurrencySeen++;
+                try {
+                    const caller = String(event?.sessionID ?? "");
+                    const running = opts.runningChildren ? opts.runningChildren(caller) : [];
+                    if (running.length > report.concurrencyRunningMax)
+                        report.concurrencyRunningMax = running.length;
+                    concurrency = concurrencyGuard(action, running, opts.maxConcurrent ?? 0);
+                    if (concurrency) {
+                        report.concurrencyDenied++;
+                        try {
+                            opts.onConcurrencyDenied?.({ caller, running, cap: opts.maxConcurrent ?? 0 });
+                        }
+                        catch {
+                            /* the trajectory line is an extra, never a reason to fail the call */
+                        }
+                    }
+                }
+                catch {
+                    report.concurrencyThrew++;
+                }
+            }
+            // The stricter of the two wins; a null on either side is not a decision.
+            const chosen = !decision ? concurrency : !concurrency ? decision : rank[concurrency.effect] > rank[decision.effect] ? concurrency : decision;
+            if (!chosen)
                 return;
             if (action === "shell")
                 report.shellMatched++;
+            if (chosen.why === "env-file-path")
+                report.envFileDenied++;
             // Only ever stricter.  A host that already decided to ask or deny keeps
             // that decision — our classifier is a floor, not an override of the user.
-            if (rank[decision.effect] <= rank[event.effect ?? "allow"])
+            if (rank[chosen.effect] <= rank[event.effect ?? "allow"])
                 return;
-            event.effect = decision.effect;
-            if (decision.message)
-                event.message = decision.message;
-            if (decision.effect === "deny")
+            event.effect = chosen.effect;
+            if (chosen.message)
+                event.message = chosen.message;
+            if (chosen.effect === "deny")
                 report.denied++;
             else
                 report.strictened++;
@@ -174,6 +293,98 @@ export async function applyV2PermissionGuards(ctx, opts) {
     ];
     return { registrations, report, installed: true };
 }
+/**
+ * The path-class fields each native file tool can carry in its `execute.before`
+ * `input`.  This is the seam `permission.evaluate` cannot cover: the host's own
+ * docs say `grep`'s resource is "the requested pattern, not the search path",
+ * and `glob`'s is the pattern too — so a `grep SECRET in .env` reaches
+ * `evaluate` with `resources:["SECRET"]` and the env-file path is never seen
+ * (#58, measured on 2.0.24: `read .env` denied, `grep` in `.env` succeeded).
+ *
+ * `grep`'s `pattern` is deliberately ABSENT: it is a REGEX, not a path, and
+ * `isEnvFilePath` on a regex misfires (a search for `\.env` is not a read of
+ * `.env`).  `glob`'s `pattern` IS a path glob, so it is checked.  `include` is
+ * the host's own filter field and is checked wherever it appears.
+ */
+const ENV_FILE_INPUT_FIELDS = {
+    read: ["filePath", "path"],
+    write: ["filePath", "path"],
+    edit: ["filePath", "path"],
+    glob: ["pattern", "path", "include"],
+    grep: ["path", "include"],
+};
+/**
+ * R6's file-path face, on the seam that sees the WHOLE input (#58).
+ *
+ * `pathGuard` rides `permission.evaluate`, whose `resources` for `grep`/`glob`
+ * are the pattern — so the red line had a hole exactly the width of those two
+ * tools.  `execute.before` hands us the raw args the model sent, so the search
+ * path (`path` / `include` / `filePath`) is visible there and the same
+ * `isEnvFilePath` matcher can answer.
+ *
+ * A refusal is THROWN, not returned: `execute.before` has no `effect` field, and
+ * silently rewriting a path the model chose is the guesswork this product
+ * refuses — the model has to see the refusal.  Same shape as the browser gate's
+ * red line.  An internal failure is swallowed and counted (`envFileInputThrew`),
+ * never thrown into the host: a guard that cannot decide must not break the call
+ * it is inspecting.  Team-scoped through the same `scope.decide` gate as every
+ * other writer, and the counters land on `v2-surface` / `v2-shutdown`.
+ */
+export async function applyV2EnvFileInputGuard(ctx, opts) {
+    const report = opts.report;
+    const tool = ctx.tool;
+    if (!tool || typeof tool.hook !== "function")
+        return { registrations: [] };
+    if (opts.envProtectMode === "off")
+        return { registrations: [] };
+    let registrations;
+    try {
+        registrations = [
+            await tool.hook("execute.before", (event) => {
+                let refusal = null;
+                try {
+                    const name = String(event?.tool ?? "");
+                    const fields = ENV_FILE_INPUT_FIELDS[name];
+                    if (!fields)
+                        return;
+                    report.envFileInputSeen++;
+                    if (opts.scope && opts.scope.count(opts.scope.decide(event)) !== "ours") {
+                        report.envFileInputForeignSkipped++;
+                        return;
+                    }
+                    const input = event.input;
+                    if (!input || typeof input !== "object" || Array.isArray(input))
+                        return;
+                    for (const field of fields) {
+                        const value = input[field];
+                        if (typeof value !== "string" || !value.trim())
+                            continue;
+                        if (isEnvFilePath(value)) {
+                            refusal = `R6 红线：${name} 的 ${field} 指向环境文件（.env / shell rc 家族），不授权、不弹窗。`;
+                            break;
+                        }
+                    }
+                }
+                catch {
+                    // A guard that cannot decide must not break the call it is inspecting:
+                    // leave the args exactly as the model wrote them and count it.
+                    report.envFileInputThrew++;
+                    return;
+                }
+                if (!refusal)
+                    return;
+                report.envFileDeniedByInput++;
+                throw new Error(refusal);
+            }),
+        ];
+    }
+    catch {
+        // No hook seam (an older host, or a ctx without `tool.hook`): the input face
+        // is simply absent, and the counters say so rather than throwing into boot.
+        return { registrations: [] };
+    }
+    return { registrations };
+}
 /** Does the config still need the coarse `shell -> ask` escalation?  Only while
  *  the fine path is switched off; with the classifier in charge, escalating every
  *  command would mask it.
@@ -196,4 +407,109 @@ export function needsCoarseShellAsk(env, guardsInstalled) {
         return true;
     return false;
 }
+// ---------- 3. the shell timeout clamp (issue #6, ported from v1) ----------
+/** The host's tool id on v2 is `shell`; v1 spelled it `bash`, and a namespaced
+ *  delivery (`opencode:shell`, `local/shell`) is the same tool.  Anything else —
+ *  including the Code Mode `execute` program that calls shell inside it — is not
+ *  ours to rewrite. */
+function isShellTool(raw) {
+    const text = String(raw ?? "").trim().toLowerCase();
+    if (!text)
+        return false;
+    const last = text.slice(Math.max(text.lastIndexOf(":"), text.lastIndexOf("/")) + 1);
+    return last === "shell" || last === "bash";
+}
+/** Parse the model-supplied timeout defensively: the host schema wants a positive
+ *  integer of milliseconds, but an LLM hands us `"120000"`, `120000.0`, or omits
+ *  it entirely.  Anything unreadable means "no timeout was supplied", and a
+ *  supplied-none is NEVER turned into one by us. */
+export function parseShellTimeout(raw) {
+    if (typeof raw === "number" && Number.isFinite(raw) && raw > 0)
+        return Math.trunc(raw);
+    if (typeof raw === "string") {
+        const n = Number(raw.trim());
+        if (Number.isFinite(n) && n > 0)
+            return Math.trunc(n);
+    }
+    return null;
+}
+/**
+ * Decide the clamped timeout for one shell call.  `probeMs` / `maxMs` of 0
+ * disable that ceiling.  `probeMs` applies ONLY to a command the P3 read-only
+ * allowlist already accepts; `maxMs` is the operator's explicit global cap and
+ * ships at 0 (off), because silently killing a build is worse than a slow one.
+ */
+export function resolveShellTimeout(opts) {
+    const t = opts.timeoutMs;
+    if (t === null)
+        return { changed: false, via: "none" };
+    const probe = opts.probeMs > 0 && classifyReadonlyCommand(opts.command, opts.readonlyAllowed).ok;
+    if (probe && t > opts.probeMs)
+        return { changed: true, via: "probe", from: t, to: opts.probeMs };
+    if (opts.maxMs > 0 && t > opts.maxMs)
+        return { changed: true, via: "max", from: t, to: opts.maxMs };
+    if (!probe && opts.maxMs === 0)
+        return { changed: false, via: "none" };
+    return { changed: false, via: "already-short" };
+}
+/**
+ * The `tool.hook("execute.before")` installation of the clamp.  Returns the
+ * registrations plus the counters that ride `v2-surface` / `v2-shutdown`.
+ * `onClamp` is how the caller writes the trajectory row; a throw inside it is
+ * swallowed there, never here.
+ */
+export async function applyV2ShellTimeoutClamp(ctx, opts) {
+    const report = { seen: 0, clamped: 0, foreignSkipped: 0, threw: 0 };
+    const tool = ctx.tool;
+    if (!tool || typeof tool.hook !== "function")
+        return { registrations: [], report };
+    let registrations;
+    try {
+        registrations = [
+            await tool.hook("execute.before", (event) => {
+                try {
+                    if (!isShellTool(event?.tool))
+                        return;
+                    report.seen++;
+                    if (opts.scope && opts.scope.count(opts.scope.decide(event)) !== "ours") {
+                        report.foreignSkipped++;
+                        return;
+                    }
+                    const input = event.input;
+                    if (!input || typeof input !== "object" || Array.isArray(input))
+                        return;
+                    const command = typeof input.command === "string" ? input.command : "";
+                    if (!command)
+                        return;
+                    const verdict = resolveShellTimeout({
+                        command,
+                        timeoutMs: parseShellTimeout(input.timeout),
+                        probeMs: opts.probeMs,
+                        maxMs: opts.maxMs,
+                        readonlyAllowed: opts.readonlyAllowed,
+                    });
+                    if (!verdict.changed)
+                        return;
+                    // Only the number the model volunteered.  `input.command` is never
+                    // touched, and nothing is added to the object.
+                    input.timeout = verdict.to;
+                    report.clamped++;
+                    const sessionID = typeof event.sessionID === "string" ? event.sessionID : undefined;
+                    opts.onClamp?.({ via: verdict.via, from: verdict.from, to: verdict.to, sessionID });
+                }
+                catch {
+                    // A clamp that cannot decide must not break the call it is trying to
+                    // speed up: leave the args exactly as the model wrote them and count it.
+                    report.threw++;
+                }
+            }),
+        ];
+    }
+    catch {
+        // No hook seam (an older host, or a ctx without `tool.hook`): the clamp is
+        // simply absent, and the counters say so rather than throwing into boot.
+        return { registrations: [], report };
+    }
+    return { registrations, report };
+}
 //# sourceMappingURL=v2-guard.js.map

package/dist/host/v2-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"v2-guard.js","sourceRoot":"","sources":["../../src/host/v2-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,EACxB,2BAA2B,EAC3B,aAAa,GAEd,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAW9C,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAW,CAAA;AAEnD;2DAC2D;AAC3D,SAAS,MAAM,CAAC,IAAY;IAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IACrB,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,wCAAwC;IACxC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACrD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,QAAQ,CAAC,SAA4B;IACnD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;QAC9B,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAA;QAC7G,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QACzB,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAClC,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAClC,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,UAAU,OAAO,CAAC,GAAG,IAAI,WAAW,EAAE;gBAC3C,OAAO,EAAE,GAAG,IAAI,mBAAmB,OAAO,CAAC,GAAG,IAAI,MAAM,+CAA+C;aACxG,CAAA;QACH,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO;gBACL,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,kBAAkB,OAAO,CAAC,GAAG,IAAI,SAAS,EAAE;gBACjD,OAAO,EAAE,GAAG,IAAI,aAAa,OAAO,CAAC,GAAG,IAAI,IAAI,uDAAuD;aACxG,CAAA;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,UAAU,CAAC,OAA2B,EAAE,IAAoB;IAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACzC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IACxC,IAAI,2BAA2B,CAAC,IAAI,EAAE,2BAA2B,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAA;IAC/F,CAAC;IACD,IAAI,2BAA2B,CAAC,IAAI,EAAE,wBAAwB,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAA;IAC3E,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAqBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAc,EACd,OAA8B,EAAE;IAEhC,MAAM,MAAM,GAA0B,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;IAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACrB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,CAAA;IAClF,MAAM,aAAa,GAAG;QACpB,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1C,IAAI,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,KAAK,UAAU;gBAAE,OAAM;YACpD,2EAA2E;YAC3E,yEAAyE;YACzE,2DAA2D;YAC3D,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM;gBAAE,OAAM;YAC/E,MAAM,KAAK,GAAG,KAAK,CAAC,KAA4C,CAAA;YAChE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAM;YACvE,MAAM,CAAC,IAAI,EAAE,CAAA;YACb,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;gBAAE,OAAM;YACrC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAA;YACvB,MAAM,CAAC,MAAM,EAAE,CAAA;QACjB,CAAC,CAAC;KACH,CAAA;IACD,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAA;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAc,EACd,IAA2D;IAE3D,MAAM,MAAM,GAAgB,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAA;IACnH,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAA;IACjC,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACzD,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;IACxD,CAAC;IAED,MAAM,aAAa,GAAG;QACpB,MAAM,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAA;YAC1C,MAAM,SAAS,GAAa,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAChG,MAAM,CAAC,IAAI,EAAE,CAAA;YACb,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;YAC5D,4EAA4E;YAC5E,2EAA2E;YAC3E,qEAAqE;YACrE,iEAAiE;YACjE,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;gBACxE,MAAM,CAAC,cAAc,EAAE,CAAA;gBACvB,OAAM;YACR,CAAC;YAED,MAAM,QAAQ,GACZ,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,WAAW;gBAC7C,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;gBACrB,CAAC,CAAC,MAAM,KAAK,OAAO;oBAClB,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC;oBAC/C,CAAC,CAAC,IAAI,CAAA;YACZ,IAAI,CAAC,QAAQ;gBAAE,OAAM;YAErB,IAAI,MAAM,KAAK,OAAO;gBAAE,MAAM,CAAC,YAAY,EAAE,CAAA;YAC7C,wEAAwE;YACxE,0EAA0E;YAC1E,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC;gBAAE,OAAM;YAClE,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;YAC9B,IAAI,QAAQ,CAAC,OAAO;gBAAE,KAAK,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAA;YACtD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM;gBAAE,MAAM,CAAC,MAAM,EAAE,CAAA;;gBAC1C,MAAM,CAAC,UAAU,EAAE,CAAA;QAC1B,CAAC,CAAC;KACH,CAAA;IAED,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAsB,EAAE,eAAwB;IAClF,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAA;IACjC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACjD,2EAA2E;IAC3E,kEAAkE;IAClE,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9C,OAAO,KAAK,CAAA;AACd,CAAC"}
+{"version":3,"file":"v2-guard.js","sourceRoot":"","sources":["../../src/host/v2-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,EACxB,2BAA2B,EAC3B,aAAa,GAEd,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AAWxD,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAW,CAAA;AAEnD;2DAC2D;AAC3D,SAAS,MAAM,CAAC,IAAY;IAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IACrB,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,wCAAwC;IACxC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACrD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,QAAQ,CAAC,SAA4B;IACnD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;QAC9B,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAA;QAC7G,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QACzB,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAClC,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAClC,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,UAAU,OAAO,CAAC,GAAG,IAAI,WAAW,EAAE;gBAC3C,OAAO,EAAE,GAAG,IAAI,mBAAmB,OAAO,CAAC,GAAG,IAAI,MAAM,+CAA+C;aACxG,CAAA;QACH,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO;gBACL,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,kBAAkB,OAAO,CAAC,GAAG,IAAI,SAAS,EAAE;gBACjD,OAAO,EAAE,GAAG,IAAI,aAAa,OAAO,CAAC,GAAG,IAAI,IAAI,uDAAuD;aACxG,CAAA;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;wEAEwE;AACxE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAE7E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,SAA4B,EAAE,IAAoB;IAC1F,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IAC/B,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAChD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;QAC9B,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAA;QAC3G,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,UAAU,CAAC,OAA2B,EAAE,IAAoB;IAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACzC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IACxC,IAAI,2BAA2B,CAAC,IAAI,EAAE,2BAA2B,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAA;IAC/F,CAAC;IACD,IAAI,2BAA2B,CAAC,IAAI,EAAE,wBAAwB,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAA;IAC3E,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AASD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,OAAgC,EAAE,GAAW;IAC5F,IAAI,MAAM,KAAK,UAAU;QAAE,OAAO,IAAI,CAAA;IACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAClD,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAA;IACrC,MAAM,IAAI,GAAG,OAAO;SACjB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;QACjH,OAAO,GAAG,CAAC,CAAC,SAAS,GAAG,IAAI,EAAE,CAAA;IAChC,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAA;IACZ,OAAO;QACL,MAAM,EAAE,MAAM;QACd,GAAG,EAAE,iBAAiB;QACtB,OAAO,EAAE,SAAS,OAAO,CAAC,MAAM,cAAc,GAAG,KAAK,IAAI,wDAAwD;KACnH,CAAA;AACH,CAAC;AA8CD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAc,EACd,OAA8B,EAAE;IAEhC,MAAM,MAAM,GAA0B,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;IAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACrB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,CAAA;IAClF,MAAM,aAAa,GAAG;QACpB,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1C,IAAI,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,KAAK,UAAU;gBAAE,OAAM;YACpD,2EAA2E;YAC3E,yEAAyE;YACzE,2DAA2D;YAC3D,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM;gBAAE,OAAM;YAC/E,MAAM,KAAK,GAAG,KAAK,CAAC,KAA4C,CAAA;YAChE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAM;YACvE,MAAM,CAAC,IAAI,EAAE,CAAA;YACb,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;gBAAE,OAAM;YACrC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAA;YACvB,MAAM,CAAC,MAAM,EAAE,CAAA;QACjB,CAAC,CAAC;KACH,CAAA;IACD,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAA;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAc,EACd,IAaC;IAED,MAAM,MAAM,GAAgB,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,oBAAoB,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,0BAA0B,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,qBAAqB,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAA;IACjU,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAA;IACjC,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACzD,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;IACxD,CAAC;IAED,MAAM,aAAa,GAAG;QACpB,MAAM,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAA;YAC1C,MAAM,SAAS,GAAa,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAChG,MAAM,CAAC,IAAI,EAAE,CAAA;YACb,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;YAC5D,4EAA4E;YAC5E,2EAA2E;YAC3E,qEAAqE;YACrE,iEAAiE;YACjE,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;gBACxE,MAAM,CAAC,cAAc,EAAE,CAAA;gBACvB,OAAM;YACR,CAAC;YAED,MAAM,QAAQ,GACZ,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,WAAW;gBAC7C,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;gBACrB,CAAC,CAAC,MAAM,KAAK,OAAO;oBAClB,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC;oBAC/C,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;YAEzD,uEAAuE;YACvE,6EAA6E;YAC7E,6EAA6E;YAC7E,0EAA0E;YAC1E,mDAAmD;YACnD,IAAI,WAAW,GAAyB,IAAI,CAAA;YAC5C,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC1B,MAAM,CAAC,eAAe,EAAE,CAAA;gBACxB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,CAAE,KAAiC,EAAE,SAAS,IAAI,EAAE,CAAC,CAAA;oBAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;oBACxE,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,qBAAqB;wBAAE,MAAM,CAAC,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAA;oBAChG,WAAW,GAAG,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,CAAA;oBACxE,IAAI,WAAW,EAAE,CAAC;wBAChB,MAAM,CAAC,iBAAiB,EAAE,CAAA;wBAC1B,IAAI,CAAC;4BACH,IAAI,CAAC,mBAAmB,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC,CAAA;wBAC/E,CAAC;wBAAC,MAAM,CAAC;4BACP,sEAAsE;wBACxE,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CAAC,gBAAgB,EAAE,CAAA;gBAC3B,CAAC;YACH,CAAC;YAED,yEAAyE;YACzE,MAAM,MAAM,GACV,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAA;YAC/H,IAAI,CAAC,MAAM;gBAAE,OAAM;YAEnB,IAAI,MAAM,KAAK,OAAO;gBAAE,MAAM,CAAC,YAAY,EAAE,CAAA;YAC7C,IAAI,MAAM,CAAC,GAAG,KAAK,eAAe;gBAAE,MAAM,CAAC,aAAa,EAAE,CAAA;YAC1D,wEAAwE;YACxE,0EAA0E;YAC1E,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC;gBAAE,OAAM;YAChE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;YAC5B,IAAI,MAAM,CAAC,OAAO;gBAAE,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;YAClD,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;gBAAE,MAAM,CAAC,MAAM,EAAE,CAAA;;gBACxC,MAAM,CAAC,UAAU,EAAE,CAAA;QAC1B,CAAC,CAAC;KACH,CAAA;IAED,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,qBAAqB,GAAsC;IAC/D,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;IAC3B,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC;IACpC,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;CAC1B,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAc,EACd,IAAgF;IAEhF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACrB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,CAAA;IAC1E,IAAI,IAAI,CAAC,cAAc,KAAK,KAAK;QAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,CAAA;IAC/D,IAAI,aAA+B,CAAA;IACnC,IAAI,CAAC;QACH,aAAa,GAAG;YACd,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC1C,IAAI,OAAO,GAAkB,IAAI,CAAA;gBACjC,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;oBACtC,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAA;oBAC1C,IAAI,CAAC,MAAM;wBAAE,OAAM;oBACnB,MAAM,CAAC,gBAAgB,EAAE,CAAA;oBACzB,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;wBACxE,MAAM,CAAC,0BAA0B,EAAE,CAAA;wBACnC,OAAM;oBACR,CAAC;oBACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAA4C,CAAA;oBAChE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;wBAAE,OAAM;oBACvE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;wBAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;wBAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;4BAAE,SAAQ;wBACxD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;4BACzB,OAAO,GAAG,SAAS,IAAI,MAAM,KAAK,sCAAsC,CAAA;4BACxE,MAAK;wBACP,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,uEAAuE;oBACvE,+DAA+D;oBAC/D,MAAM,CAAC,iBAAiB,EAAE,CAAA;oBAC1B,OAAM;gBACR,CAAC;gBACD,IAAI,CAAC,OAAO;oBAAE,OAAM;gBACpB,MAAM,CAAC,oBAAoB,EAAE,CAAA;gBAC7B,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAA;YAC1B,CAAC,CAAC;SACH,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;QAC7E,4EAA4E;QAC5E,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,CAAA;IAC9B,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAsB,EAAE,eAAwB;IAClF,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAA;IACjC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACjD,2EAA2E;IAC3E,kEAAkE;IAClE,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9C,OAAO,KAAK,CAAA;AACd,CAAC;AAED,8EAA8E;AAE9E;;;uBAGuB;AACvB,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACnD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACnF,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,CAAA;AAC5C,CAAC;AAED;;;oDAGoD;AACpD,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACtF,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QAC5B,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAMD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAMnC;IACC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAA;IACxB,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAA;IAChG,IAAI,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;IAChG,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,CAAA;IACnG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;IACtE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,CAAA;AACjD,CAAC;AAcD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAc,EACd,IAMC;IAED,MAAM,MAAM,GAAuB,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;IACvF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACrB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,CAAA;IAClF,IAAI,aAA+B,CAAA;IACnC,IAAI,CAAC;QACH,aAAa,GAAG;YACd,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC1C,IAAI,CAAC;oBACH,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC;wBAAE,OAAM;oBACrC,MAAM,CAAC,IAAI,EAAE,CAAA;oBACb,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;wBACxE,MAAM,CAAC,cAAc,EAAE,CAAA;wBACvB,OAAM;oBACR,CAAC;oBACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAA4C,CAAA;oBAChE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;wBAAE,OAAM;oBACvE,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;oBACtE,IAAI,CAAC,OAAO;wBAAE,OAAM;oBACpB,MAAM,OAAO,GAAG,mBAAmB,CAAC;wBAClC,OAAO;wBACP,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC;wBAC3C,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,eAAe,EAAE,IAAI,CAAC,eAAe;qBACtC,CAAC,CAAA;oBACF,IAAI,CAAC,OAAO,CAAC,OAAO;wBAAE,OAAM;oBAC5B,mEAAmE;oBACnE,+CAA+C;oBAC/C,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC,EAAE,CAAA;oBAC1B,MAAM,CAAC,OAAO,EAAE,CAAA;oBAChB,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;oBACnF,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;gBACrF,CAAC;gBAAC,MAAM,CAAC;oBACP,qEAAqE;oBACrE,yEAAyE;oBACzE,MAAM,CAAC,KAAK,EAAE,CAAA;gBAChB,CAAC;YACH,CAAC,CAAC;SACH,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,yEAAyE;QACzE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,CAAA;IACtC,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAA;AAClC,CAAC"}